Analysis

  • max time kernel
    142s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2024, 05:47 UTC

General

  • Target

    eab2bb0ef5b0f3848cc64506655dc4d7_JaffaCakes118.exe

  • Size

    750KB

  • MD5

    eab2bb0ef5b0f3848cc64506655dc4d7

  • SHA1

    561385996f1739ea6bfaac0a7cbf27698bddfb7f

  • SHA256

    3a913114cba8e4160c18ff483bd15c1906615facd1da1e34335210f56075ef9f

  • SHA512

    dbfb2c04a0884a26470ae09b15c5bda22ad066e0e2f75e33a18e5af501584420050820caf2fc50049eaa54471b6119b1569b9e0bdd33cf7b77e6d1f638f47b90

  • SSDEEP

    12288:4upCHIvNfPVUbPVIAkDYBGRqnRyktfuoBCzWsdPTDPfJ4F3Z4mxxZo3ABt4QCde5:xpKIxAmuBGRWRyktpK1dPTLJ4QmXZQup

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eab2bb0ef5b0f3848cc64506655dc4d7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eab2bb0ef5b0f3848cc64506655dc4d7_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1EXE~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1EXE~1.EXE
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Windows\RunMgr.EXE
        "C:\Windows\RunMgr.EXE"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3000
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c del %SystemRoot%\Debug.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2632
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1EXE~1.EXE > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2768
  • C:\Windows\Hacker.com.cn.exe
    C:\Windows\Hacker.com.cn.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
        PID:672

    Network

      No results found
    • 127.0.0.1:8000
      Hacker.com.cn.exe
    • 127.0.0.1:8000
      Hacker.com.cn.exe
    • 127.0.0.1:8000
      Hacker.com.cn.exe
    • 127.0.0.1:8000
      Hacker.com.cn.exe
    No results found

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\RunMgr.EXE

      Filesize

      376KB

      MD5

      26352054385070eb54ed35f106011c45

      SHA1

      68c86412a280a109f9ac3b662aa05654b40e5220

      SHA256

      180aeccac2b2e162a27a7465adb12cdc0d906e9cb951f1b6e1d6d744945213ce

      SHA512

      a2c5f602432bc9b40f1c4daef2f7a84f1b8d7e0f65c0a875551fb762c15216e973c6a3b2e0309e26d7970522bfbf5942f2148edf8382c400b2c1f20766688235

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\1EXE~1.EXE

      Filesize

      428KB

      MD5

      892360f7cb280d61e64608d1626da691

      SHA1

      5465140d70dca843b6552575db3332900e08748e

      SHA256

      61ae9484b94614f0faa4cc29ec24a544b5d355314b4ae54c9b91bb6dba592570

      SHA512

      77eccebe235932c12e6b8a878f8ca3e700fd83fa6fe15afb5761ea5e04e0042f68c35f2db30720dc47fcb1efe77855fc3fac92cc21637d512406a8129f050ef3

    • memory/2112-118-0x0000000000400000-0x00000000004C8400-memory.dmp

      Filesize

      801KB

    • memory/2112-84-0x0000000000400000-0x00000000004C8400-memory.dmp

      Filesize

      801KB

    • memory/2148-18-0x00000000002A0000-0x00000000002A1000-memory.dmp

      Filesize

      4KB

    • memory/2148-14-0x0000000000500000-0x0000000000501000-memory.dmp

      Filesize

      4KB

    • memory/2148-7-0x0000000000200000-0x0000000000201000-memory.dmp

      Filesize

      4KB

    • memory/2148-6-0x0000000000180000-0x0000000000181000-memory.dmp

      Filesize

      4KB

    • memory/2148-5-0x0000000000190000-0x0000000000191000-memory.dmp

      Filesize

      4KB

    • memory/2148-4-0x0000000000270000-0x0000000000271000-memory.dmp

      Filesize

      4KB

    • memory/2148-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

      Filesize

      4KB

    • memory/2148-2-0x00000000001E0000-0x00000000001E1000-memory.dmp

      Filesize

      4KB

    • memory/2148-54-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-53-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-52-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-51-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-50-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-49-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-48-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-47-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-46-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-45-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-44-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-43-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-15-0x00000000004E0000-0x00000000004E1000-memory.dmp

      Filesize

      4KB

    • memory/2148-41-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-40-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-39-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-38-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-37-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-36-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-35-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-34-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-33-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-32-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-31-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-30-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-29-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-28-0x0000000000950000-0x0000000000951000-memory.dmp

      Filesize

      4KB

    • memory/2148-27-0x0000000000960000-0x0000000000961000-memory.dmp

      Filesize

      4KB

    • memory/2148-26-0x00000000008F0000-0x00000000008F1000-memory.dmp

      Filesize

      4KB

    • memory/2148-25-0x0000000000900000-0x0000000000901000-memory.dmp

      Filesize

      4KB

    • memory/2148-24-0x0000000000920000-0x0000000000921000-memory.dmp

      Filesize

      4KB

    • memory/2148-23-0x0000000000940000-0x0000000000941000-memory.dmp

      Filesize

      4KB

    • memory/2148-22-0x00000000002C0000-0x00000000002C1000-memory.dmp

      Filesize

      4KB

    • memory/2148-21-0x00000000008D0000-0x00000000008D1000-memory.dmp

      Filesize

      4KB

    • memory/2148-20-0x0000000000510000-0x0000000000511000-memory.dmp

      Filesize

      4KB

    • memory/2148-19-0x0000000000520000-0x0000000000521000-memory.dmp

      Filesize

      4KB

    • memory/2148-9-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-17-0x00000000002B0000-0x00000000002B1000-memory.dmp

      Filesize

      4KB

    • memory/2148-8-0x00000000001F0000-0x00000000001F1000-memory.dmp

      Filesize

      4KB

    • memory/2148-16-0x00000000008C0000-0x00000000008C1000-memory.dmp

      Filesize

      4KB

    • memory/2148-42-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-13-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-12-0x0000000000280000-0x0000000000281000-memory.dmp

      Filesize

      4KB

    • memory/2148-11-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-10-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-64-0x0000000003580000-0x00000000035EB000-memory.dmp

      Filesize

      428KB

    • memory/2148-63-0x0000000003580000-0x00000000035EB000-memory.dmp

      Filesize

      428KB

    • memory/2148-77-0x0000000000210000-0x0000000000264000-memory.dmp

      Filesize

      336KB

    • memory/2148-75-0x0000000001000000-0x000000000112E000-memory.dmp

      Filesize

      1.2MB

    • memory/2148-132-0x0000000003580000-0x00000000035EB000-memory.dmp

      Filesize

      428KB

    • memory/2148-131-0x0000000003580000-0x00000000035EB000-memory.dmp

      Filesize

      428KB

    • memory/2148-1-0x0000000000210000-0x0000000000264000-memory.dmp

      Filesize

      336KB

    • memory/2148-0-0x0000000001000000-0x000000000112E000-memory.dmp

      Filesize

      1.2MB

    • memory/2148-114-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-113-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-88-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-89-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-90-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-91-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-92-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-93-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-94-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-95-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

    • memory/2148-96-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-97-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-98-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-99-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-100-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-101-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-102-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-103-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-104-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-105-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-106-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-107-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-108-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-109-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-110-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-111-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2148-112-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

    • memory/2880-115-0x0000000002980000-0x0000000002A49000-memory.dmp

      Filesize

      804KB

    • memory/2880-116-0x0000000002980000-0x0000000002A49000-memory.dmp

      Filesize

      804KB

    • memory/2880-76-0x0000000002980000-0x0000000002A49000-memory.dmp

      Filesize

      804KB

    • memory/2880-73-0x0000000002980000-0x0000000002A49000-memory.dmp

      Filesize

      804KB

    • memory/2880-66-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/3000-87-0x0000000000400000-0x00000000004C8400-memory.dmp

      Filesize

      801KB

    • memory/3000-78-0x0000000000400000-0x00000000004C8400-memory.dmp

      Filesize

      801KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.