Analysis

  • max time kernel
    140s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 04:38

General

  • Target

    df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe

  • Size

    1.7MB

  • MD5

    df815d13a8c5804d6f3f43b16390d9e4

  • SHA1

    8e804769a245b28b22af42b225a5bf1949eea52b

  • SHA256

    5cc477a5fa3fbc22c8f0fc8e86ac999de8fd7308223925d0a712eaedd8fe37b2

  • SHA512

    d38b4da21e0ee8f155c4883aaafb8816c28f7b9387232ae60786900cb60cb9a214ae6cf312779f9ee98b4b7c9ef77ee3f45eab786fade38340a4940eaf0add91

  • SSDEEP

    49152:v2tjrwtaghVJXh5kZ+0opZavj+cCQwmFjSEjDaV:ut/qai/a7+zQw6w

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:224
    • C:\Users\Admin\AppData\Local\Temp\is-CNP34.tmp\df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-CNP34.tmp\df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.tmp" /SL5="$601E0,1414789,53248,C:\Users\Admin\AppData\Local\Temp\df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-CNP34.tmp\df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.tmp

    Filesize

    669KB

    MD5

    52950ac9e2b481453082f096120e355a

    SHA1

    159c09db1abcee9114b4f792ffba255c78a6e6c3

    SHA256

    25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd

    SHA512

    5b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba

  • C:\Users\Admin\AppData\Local\Temp\is-MR1DM.tmp\Games.inf

    Filesize

    184B

    MD5

    99f6101143e183bd54587095f775658a

    SHA1

    b4137e88fbf26d790bd98a3a81c9da5f170a4f6b

    SHA256

    3475cc5c9b0ebbae27023b55f21ba8e11e84d32112b71614ff3dc708e9d1473b

    SHA512

    09ab56440867a523483cefb4d0d6b66fb395ebc4a3e4127384e132c54e73e8266f95ac59fdde3d4dac6a02895a08a38dd5b47c3c988db16d9536e021b139dbee

  • C:\Users\Admin\AppData\Local\Temp\is-MR1DM.tmp\isxdl.dll

    Filesize

    49KB

    MD5

    02ecc74f7f91e9ffd84de708683236a6

    SHA1

    3532de0b77df8b0fc89e9c7eddec3fa71f98f5a2

    SHA256

    30ad8a0e1cee091ca48c771adb2e76baf1a7d54b9f60dc47f54dfdc2d6f6691e

    SHA512

    a3fdaa651f82428395bc412a2a04fce673768d3ef088b3748addf337d95464eb141ae7c286bff5c705eae05dd7b38207629588ae7e89ada15269463cd7acf541

  • memory/224-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/224-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/224-30-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1412-7-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1412-31-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB