Analysis

  • max time kernel
    124s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-09-2024 01:41

General

  • Target

    eed53fec8226e1a3b0b94c4424515e88_JaffaCakes118.exe

  • Size

    246KB

  • MD5

    eed53fec8226e1a3b0b94c4424515e88

  • SHA1

    1500b4c1d6b5e2d33c0a2b78e2e845c9beb71096

  • SHA256

    cb8ed16c1c8e437bccc24dba6c34753f06d9219e7be714523c04c8b359608e2d

  • SHA512

    e0fd8a243b2d108bf3ea0f95b19844ca8e894f731e39d2ff83b9119998bde72c5dedf89da635aca7ab57158c4d1d0c556f835a6b8345f5b314479ebbf4ec584b

  • SSDEEP

    6144:MxjSWVWqnhOVNFLciyG2TShNuSLQsr6gODNT:kVxnEVzEGvuiqDN

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:336
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\eed53fec8226e1a3b0b94c4424515e88_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\eed53fec8226e1a3b0b94c4424515e88_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Users\Admin\AppData\Local\615578cd\X
        *0*cb*ef81818b*69.64.52.10:53
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2348
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2792
  • C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    1⤵
      PID:2628

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\615578cd\X

      Filesize

      38KB

      MD5

      72de2dadaf875e2fd7614e100419033c

      SHA1

      5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

      SHA256

      c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

      SHA512

      e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

    • \Windows\System32\consrv.dll

      Filesize

      29KB

      MD5

      1149c1bd71248a9d170e4568fb08df30

      SHA1

      6f77f183d65709901f476c5d6eebaed060a495f9

      SHA256

      c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

      SHA512

      9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

    • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

      Filesize

      2KB

      MD5

      2eb4ae0a269cfb8efd5072ad24c6fb27

      SHA1

      f36d5f7a45c58d9d34e45ec67fa4ca201d104fc9

      SHA256

      995ecf6fc17fbdd7175047401bf653e138a27b733f713e78d12dc89272ca626e

      SHA512

      51116a02ad0c8b9a48c748410c2775a9b50a245884cc46444b0cb5d9a066889d296cfcf02ce7057240906ab9241c213f5afac839bcfa9c59b8943edeb7f1ea73

    • memory/336-18-0x0000000002520000-0x000000000252B000-memory.dmp

      Filesize

      44KB

    • memory/336-42-0x0000000002520000-0x000000000252B000-memory.dmp

      Filesize

      44KB

    • memory/336-21-0x0000000002520000-0x000000000252B000-memory.dmp

      Filesize

      44KB

    • memory/336-16-0x00000000024F0000-0x00000000024F1000-memory.dmp

      Filesize

      4KB

    • memory/1192-4-0x0000000002B00000-0x0000000002B06000-memory.dmp

      Filesize

      24KB

    • memory/1192-3-0x00000000029E0000-0x00000000029E2000-memory.dmp

      Filesize

      8KB

    • memory/1192-8-0x0000000002B00000-0x0000000002B06000-memory.dmp

      Filesize

      24KB

    • memory/1192-12-0x0000000002B00000-0x0000000002B06000-memory.dmp

      Filesize

      24KB

    • memory/1192-28-0x0000000002B20000-0x0000000002B2B000-memory.dmp

      Filesize

      44KB

    • memory/1192-37-0x0000000002B20000-0x0000000002B2B000-memory.dmp

      Filesize

      44KB

    • memory/1192-36-0x0000000002B00000-0x0000000002B08000-memory.dmp

      Filesize

      32KB

    • memory/1192-43-0x0000000002EF0000-0x0000000002EFB000-memory.dmp

      Filesize

      44KB

    • memory/1192-32-0x0000000002B20000-0x0000000002B2B000-memory.dmp

      Filesize

      44KB

    • memory/1192-38-0x0000000002EF0000-0x0000000002EFB000-memory.dmp

      Filesize

      44KB

    • memory/2516-39-0x0000000030670000-0x00000000306A7000-memory.dmp

      Filesize

      220KB

    • memory/2516-40-0x0000000030670000-0x00000000306C5000-memory.dmp

      Filesize

      340KB

    • memory/2516-2-0x0000000030670000-0x00000000306C5000-memory.dmp

      Filesize

      340KB

    • memory/2516-47-0x0000000030670000-0x00000000306A7000-memory.dmp

      Filesize

      220KB

    • memory/2516-46-0x0000000030670000-0x00000000306C5000-memory.dmp

      Filesize

      340KB

    • memory/2516-1-0x0000000030670000-0x00000000306A7000-memory.dmp

      Filesize

      220KB