Analysis

  • max time kernel
    41s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-09-2024 11:47

General

  • Target

    e268d4d51db6cd652b38d723f9b0e2dd_JaffaCakes118.exe

  • Size

    328KB

  • MD5

    e268d4d51db6cd652b38d723f9b0e2dd

  • SHA1

    1bfd85b175c33e40e20ea899bcd41652e1b0bb26

  • SHA256

    2ca4f6791dae06fe2d09d4240f53f2fc8761d37c3171558a4ebb50ec8dd18cba

  • SHA512

    0c5d14b28d8daa1d8ef5cd79a67320fcc918928b58d6b50b36caf7cb33e9ebf61c4597869223c94b2267e27e1cb847fa67ea44b1c7e516f3417d3412a4cb1d66

  • SSDEEP

    6144:Jz+izw2BtU4OlX2sxVypUBMelfHeSpLoWruZP:Z+izwhmsxw4MamS5rq

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e268d4d51db6cd652b38d723f9b0e2dd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e268d4d51db6cd652b38d723f9b0e2dd_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2404
    • C:\Users\Admin\AppData\Local\Temp\mypic.exe
      "C:\Users\Admin\AppData\Local\Temp\mypic.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\mypic.exe

    Filesize

    171KB

    MD5

    df4cc1057d7a3dd2e8612e37a89fef00

    SHA1

    b9c3aa169c47861e7fd13f88820e9ba90338ab38

    SHA256

    cdcd3729090ac6b0d556311e3b2e579fd4c6eed845332556cc5766b3758f53ae

    SHA512

    0567f2119c56b2056c40093808d68d2268434a919ba601052324cdc3c280a70ba4b42bc348316786585447312fdea2e4f4732f7eb31f1e79642a2fff247f4a77

  • memory/2404-0-0x000007FEF577E000-0x000007FEF577F000-memory.dmp

    Filesize

    4KB

  • memory/2404-1-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

    Filesize

    9.6MB

  • memory/2404-4-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

    Filesize

    9.6MB

  • memory/2404-5-0x000000001B030000-0x000000001B040000-memory.dmp

    Filesize

    64KB

  • memory/2404-11-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

    Filesize

    9.6MB

  • memory/2732-12-0x0000000074361000-0x0000000074362000-memory.dmp

    Filesize

    4KB

  • memory/2732-13-0x0000000074360000-0x000000007490B000-memory.dmp

    Filesize

    5.7MB

  • memory/2732-14-0x0000000074360000-0x000000007490B000-memory.dmp

    Filesize

    5.7MB

  • memory/2732-15-0x0000000074360000-0x000000007490B000-memory.dmp

    Filesize

    5.7MB

  • memory/2732-16-0x0000000074360000-0x000000007490B000-memory.dmp

    Filesize

    5.7MB