Analysis

  • max time kernel
    125s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2024, 13:04

General

  • Target

    05ec50d5b797ebadc39b80f1ba5b5c30_JaffaCakes118.exe

  • Size

    329KB

  • MD5

    05ec50d5b797ebadc39b80f1ba5b5c30

  • SHA1

    15017bc249b7ce9757c5629272d3c1548c290777

  • SHA256

    ea0c5fe5eb6f6c850a9f8364c5f9cb174c93ba9b3ee446d36a99a2a3ea1fff02

  • SHA512

    95f280e3267daad1cbab64eef4cb556326bb32865dc06f8bed69461d5e4b35e1bf96ae440779fbb8e668befe9014fba591de3d832230b4ded89a08e5b43920f3

  • SSDEEP

    6144:siMF/X479SEAanPSIv0FB5iSbGqJQjdSHV:sI79SE1lMFmS+dYV

Malware Config

Signatures

  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\05ec50d5b797ebadc39b80f1ba5b5c30_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\05ec50d5b797ebadc39b80f1ba5b5c30_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4284
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4200,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
    1⤵
      PID:2528
    • C:\PROGRA~3\Mozilla\gmbbhqc.exe
      C:\PROGRA~3\Mozilla\gmbbhqc.exe -davvhfe
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:1592

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Mozilla\gmbbhqc.exe

      Filesize

      329KB

      MD5

      2c966dabcb734ec48d8aa7f4e882e797

      SHA1

      1e91a9d1a9f5bec8c69bf34767c9992f8db80859

      SHA256

      a0bab5f1d3b29dd27192a8ec306f3be162460be8141e810ba358c8b15eb2c7c9

      SHA512

      e754e680076bbcf2b8e5c0e18ff991c5ea47f5b446163c71bf98b81e10fede814d7ea97450d9f67a23682bfcdbd06c9edddcf9f4b52fdbbd0127db705befba5b

    • memory/1592-9-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/1592-10-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/1592-12-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/4284-0-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/4284-1-0x00000000021E0000-0x000000000223C000-memory.dmp

      Filesize

      368KB

    • memory/4284-2-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/4284-6-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/4284-8-0x00000000021E0000-0x000000000223C000-memory.dmp

      Filesize

      368KB