Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2024, 04:25

General

  • Target

    ea94754c6d1a3ec7c46046b64a499505_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    ea94754c6d1a3ec7c46046b64a499505

  • SHA1

    1c88c9e9d596e1f0d89b411726bda1e1b3272be9

  • SHA256

    237521ebc7eacb0394d7276585529344e22ba03a888720d43b79eb95f29ab186

  • SHA512

    d619fae20548bfdcdb025c6ecaec081088946b31989cfca562fac0b81d4c41ce3b89a79c502a645c1dc2d986b0130169f04458b353d2f891620ab531be0a4f2b

  • SSDEEP

    24576:hbSaE4mvt/Gqc/fVlUvnnhUw87iVdzxYQC8n:hbSv4mvYJFlUvnhA7ydeQDn

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea94754c6d1a3ec7c46046b64a499505_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ea94754c6d1a3ec7c46046b64a499505_JaffaCakes118.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Users\Admin\AppData\Local\Temp\File.exe
      "C:\Users\Admin\AppData\Local\Temp\File.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Users\Admin\AppData\Local\Temp\1431745337.exe
        C:\Users\Admin\AppData\Local\Temp\1431745337.exe 0\5\8\5\1\8\2\9\6\6\8 L0tBPzwxMDAqGidTUDpLSDw7JxopRkVPT0pRQ0c7NysYLz9BTlNBQjQrLywwMhgqQkFCNCoaJ1BNRz9UO1JWQz41MS8uNDUYLUo/TE5FTVdQUUQ7X25uaDoqJ25xbiw7P01DLU9HSyw5TkcoQ0ZGShgqQkRHOkVDPD0bJz8wNSsoGik8MjglLB8nQio3JykgKjwvPCUvFyk+LT0oKRsuSFBGPk87VFpITUhOPzpTNxgvS0pKQ01BS1k/TUw8NRsuSFBGPk87VFpGPEw9O0lfZ2d2YEFAHydDTz9ZTVJHNRsuPVY8WT1FREdBSUQ1IykqKW1yZzVjc2xuMSkpXG9yZmduWWJqKG5dY2NxYmRdaWpiaWVlKVtqLW1pJl1mXWFpJ01kZW1tX0M9LnVhayQqLiZoW2VlOEpgbGd0XEM/JnpkaBsuQE1KTlk6UkpPTkRKOykaKUxIPEZGWEdTVk9MRD0bJ1FMNTAXKT5LMTgYKlFNTEtDRz1fUj1HQkdLPENHOUdATU1LNR4mQ01XUlBGT0hFQzRubG1lGydNRExTSUhDRkdaTU5ESl07O1NLPS0YKkdBQjxSNykgKkFOXjxXRTtHQUNaPUlCSldHTj88PWFZZ3JdHiY+SU9OR0c8Q1dHRzczLS4yKCkwKzElKyouICpMREw9OyguLSk3MC0yNiweJj5JT05HRzxDV1JARz81NSopMS4qLigvJC06MC41MCwoOEcaJ1U8NUhucmdjZlsdMmEtKS8jJk5jaFxvcmsmTUwpLSgrISs8aGtrXVVcXEVhdCAqYTQrNSUtMCMoRkBPTEQjKV0lZGlmXSZGXWFiaSMjQ2NqamxdIylgLiouKyYtMikvJSsvKitOWWFgamccLGAtMzImLjUYLUxMRjVob2xrJCtfHCxgHTJhX2BzJmpmXW9rMCwoLS1hbF1pHypmTW1pU2FrXD5pb25nZ1xjRV9lW2FdclpcYG9kbXAfLF4xLyssNi0zLjAzHTJhKS8yKTUsLzEuOSAqYTAsMSgxLy03MTEgMl43LDIrLDQwKTQ4LVZkPG1GVFAvXHlvdUJOS2ZJUW8zS0xDbUZzLGRVckxyREJMK0dhRm9GPmZgVj9IXlFtZ19VMWBqTz5hYUk+aGdiTzNlRD1oYlQqb3VZQUhwUktBc1BNdmxWTTNoXG1rZ1xsOmBYY2ZqWUFsaWNPTF5UQUJxVCpVblBRKGBbcWwrUWN2bFZNL2VSRixpREM+YkpRPGNhaC1mUU1DZ19ROm5FYHJzUGsoXltPQWZDZ3NGVj5iaFxXQT5MQil2UEFtXFguPm9XT2piU2dOWVw+cjNLa0lqWytGZkk/dmBWTkxlUkdrXFxGSS5KUTxjYWgtZlFNQ19bQGhtXExMc0BsY2ZcPGdz
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3036
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81726719910.txt bios get serialnumber
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:684
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81726719910.txt bios get version
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2500
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81726719910.txt bios get version
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1660
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81726719910.txt bios get version
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1924
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81726719910.txt bios get version
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1964
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 368
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\81726719910.txt

    Filesize

    66B

    MD5

    9025468f85256136f923096b01375964

    SHA1

    7fcd174999661594fa5f88890ffb195e9858cc52

    SHA256

    d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

    SHA512

    92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

  • C:\Users\Admin\AppData\Local\Temp\CabCA43.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\File.exe

    Filesize

    581KB

    MD5

    96f22762a3acd888ed276179a8494e3f

    SHA1

    c70dbbc054917ffa3477a6d1ad50c23ed8abd91e

    SHA256

    76532221bad5fbe988feb0ea55fcc5f0fb67708658e1f09d6ba49bf270d6a9e8

    SHA512

    784a46475dc161c31ac0dad5fa5ee8f441d454ebb60f9243d8cad557cc45c71150062cb66ab25878b6b20b98dea342886e948f456bf141e98ec403057d1dc104

  • C:\Users\Admin\AppData\Local\Temp\TarCA85.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\nsyCF03.tmp\bqxdvtj.dll

    Filesize

    153KB

    MD5

    f2e061f20337c7b923cc981ffa370843

    SHA1

    80462d66ee9d812b61dc4f63c1e305d9948be20e

    SHA256

    473c19cb5364e51bcee4aa0639246a82b662a89e085bb3693c7a0d81e7ea6ef8

    SHA512

    ce59611a1d7e2982db4c1a993f6005cc7d7f1b4a66eecbb6df9eab7840a99e5c0c21ae5dda3ffd0c16f97e2c880ff6de6df169f150676a91e28228fed8980a20

  • \Users\Admin\AppData\Local\Temp\1431745337.exe

    Filesize

    788KB

    MD5

    94c3ce3856a17f09a845c84eef204247

    SHA1

    aee6896be0f74e8a4f5b24a14922dccd011ca30f

    SHA256

    37ecc9a349b93f3c02deb4ebcdc056de78fb11a1c1e76b0576b81a561205f502

    SHA512

    dd2829a01ba441c6b95624e290eaf3cdba2b32c044a7b1b15bf55f2badf5ea3f1fa4387b39e7627e3226a0b140252810f7e67ac9148f879ad53465110ee73b40

  • \Users\Admin\AppData\Local\Temp\nsyCF03.tmp\nsisunz.dll

    Filesize

    40KB

    MD5

    5f13dbc378792f23e598079fc1e4422b

    SHA1

    5813c05802f15930aa860b8363af2b58426c8adf

    SHA256

    6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

    SHA512

    9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

  • memory/2252-0-0x000007FEF53BE000-0x000007FEF53BF000-memory.dmp

    Filesize

    4KB

  • memory/2252-8-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

    Filesize

    9.6MB

  • memory/2252-62-0x000000001B0C0000-0x000000001B138000-memory.dmp

    Filesize

    480KB

  • memory/2252-110-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

    Filesize

    9.6MB