Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 02:48

General

  • Target

    0d8f31390657feafdceee1acbffde190_JaffaCakes118.exe

  • Size

    242KB

  • MD5

    0d8f31390657feafdceee1acbffde190

  • SHA1

    b21fbee6a30d4c44b60228e1a0e4cec4605a9040

  • SHA256

    2249da86ba12abbefa9c98d0a14e6cf3404a7da5854c62399b92681420459170

  • SHA512

    929bbb361e374379b16a1df205f862f583a85c02c942cb747815a48acdc58dd65aaa0808b52cbc8ee2baa3d5b80761a049d8c0517c7794cba2e9b5b9d7e221d8

  • SSDEEP

    6144:MsaocyLCk5xf1QrVcEUp16Mj3elepybnoWSgBjt0Fisj:Mtobz5xf12qEUp1DOlhbnXt8Vj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d8f31390657feafdceee1acbffde190_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0d8f31390657feafdceee1acbffde190_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Users\Admin\AppData\Local\Temp\nsjEAAF.tmp\inst.exe
      C:\Users\Admin\AppData\Local\Temp\nsjEAAF.tmp\inst.exe 4fd99101-fa18-4898-bfd9-098a5bc06f2f.exe /u4fd99101-fa18-4898-bfd9-098a5bc06f2f /e4560044 /dT131851014S /t
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:2688
      • C:\Users\Admin\AppData\Local\Temp\nsjEAAF.tmp\4fd99101-fa18-4898-bfd9-098a5bc06f2f.exe
        "C:\Users\Admin\AppData\Local\Temp\nsjEAAF.tmp\4fd99101-fa18-4898-bfd9-098a5bc06f2f.exe" /u4fd99101-fa18-4898-bfd9-098a5bc06f2f /e4560044 /dT131851014S /t
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2236

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\12236C41CDDF9E40BA5606CDF086B821

    Filesize

    76KB

    MD5

    814ec2095f3f6ac00177f839cc996cf2

    SHA1

    77863c4fa7b495ed96351602190ab3d7b50cc6a7

    SHA256

    47af1a17cb0723895141985b657882d1d0db6679ccedca7ae508b9dcd39e0d62

    SHA512

    4097999594c16045dbd1bffc1efbe615a4828e879e508e9eddb6bc97ed732aa0606fc8a6183ae9ef94563521283b3aa1901eef513bf8f8c06e1e1742e8cf1a4e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EDCF682921FE94F4A02A43CD1A28E6B

    Filesize

    604B

    MD5

    3a0e39c53630ecfc2720aee27fe32557

    SHA1

    ce9b2fbd4efce495b07ac98b4cb54b12dd3cf3c0

    SHA256

    18da8779683e3e688ac75a896d738eb4e958763e153e56cb06432bafd3d6ef38

    SHA512

    3598a8fa245b68d4ea236355c00c80710105704efb08e889edea0afd79e079224083c0d034e6b2454189bb8057ea9037ae48e0791bc5b6c54a4af90541fda166

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9

    Filesize

    5B

    MD5

    4842e206e4cfff2954901467ad54169e

    SHA1

    80c9820ff2efe8aa3d361df7011ae6eee35ec4f0

    SHA256

    2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e

    SHA512

    ff537b1808fcb03cfb52f768fbd7e7bd66baf6a8558ee5b8f2a02f629e021aa88a1df7a8750bae1f04f3b9d86da56f0bdcba2fdbc81d366da6c97eb76ecb6cba

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_CC1689C2A9A5CB35265F3C2516751959

    Filesize

    5B

    MD5

    5bfa51f3a417b98e7443eca90fc94703

    SHA1

    8c015d80b8a23f780bdd215dc842b0f5551f63bd

    SHA256

    bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

    SHA512

    4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\12236C41CDDF9E40BA5606CDF086B821

    Filesize

    202B

    MD5

    bf6d6c3d85573141139eace3827015bb

    SHA1

    718001b473c1b9f0d0b545caba40d33cabf540f4

    SHA256

    01de72cc742f84e567dc1951d9fc1979d139f0d8041aee04be80b26062e98950

    SHA512

    a705bd837957e295e16e2d5d1afa6a5c4482b57ebb4ffb9dbd8146f2f34529bb370efcfa95f186703948383e79bf711cedd99ff24b92710384083f6069267dd7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F39B5CFACECFDE48DB25BCA2231FAC6_D73FEE3C4E574541538B35CF985ADB66

    Filesize

    490B

    MD5

    2c25fce1cfc86d8398c5e06b16602b6d

    SHA1

    52dbc84430632332586d2826180bb6ffd3daf643

    SHA256

    df87091f9fc31f9e7369ea0029d817c86ea4b9e12ac374ba2e76fdcc516df384

    SHA512

    98ee4714b8c89085094ee06a6e0ed2cef53da0d52fd6d1d4b97e34dced5db25fa7f35a44f05f675c8a03851bfc15eb35545a4d275ec2884b3ef0267857d7d943

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F39B5CFACECFDE48DB25BCA2231FAC6_F0E2901B5CB9DFCB03318B8D06C40A30

    Filesize

    412B

    MD5

    0ff1df308e0c0d598096e43653432733

    SHA1

    e636a6c319fa09a85bcc0814e14ece852c4134d2

    SHA256

    e5ab38c16666b3dfea2d30423088ba86c5e0c93b6f1e9dfec9d575d7045bf1c3

    SHA512

    337dc3b2bb7ec35f51148d35e8c2688673b6550bca941ced42487a7d09d399e27210c05067f3f517e101d0174f88ea6e27b7feeb02194c3f95be6fc64e7050be

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EDCF682921FE94F4A02A43CD1A28E6B

    Filesize

    188B

    MD5

    5480ea55b151cbac3e4d00b2a0c48a59

    SHA1

    43eb29cc1aa182f68aa15a919d838948780d3a9e

    SHA256

    42f3a802c9f6f196c347fa089b3b046db61bf0acf699d6edb4d983ec068dbc1d

    SHA512

    45270f20e26b09f4daad508fd4b12861704a2daf7eaa92c0ad06d502305a983366695d4e46c538e661e8c528a144af9e1ff078e6e6cd7a29731bae893d739fcc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6319b6a9b14192036a927e19bdf31fff

    SHA1

    813cf7482589f45c5d5ae8468afec3cd1d5b65f1

    SHA256

    68bdd9fe263583e15d732af28728bb88a5af40d4515c37beee25b3b8b96051ba

    SHA512

    92a2b511096c378dae28f2419f183fa5e4445ad588dec1b84a37531545df279d3c059677284149a7940fed243569cfe94f1b9b439d92571366574edc397cfdb2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9

    Filesize

    404B

    MD5

    6c01d3c9ba13715ad5376ba6f4dcedaf

    SHA1

    35ce176c12b7a84ff4796ad198c8196279e07818

    SHA256

    c3b843c682dee583a06d8160c265005cb12b07fb23bd58b8303ebf8069b1ba2b

    SHA512

    49238aa72bbf18ca1a7c6bb2fb21bb70a59cf04cf0862d85384e4acec76804d4f82a6dd0686907ef9d252e906aeb75d7ee1536f674c47236d19331b66097db1a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_CC1689C2A9A5CB35265F3C2516751959

    Filesize

    482B

    MD5

    e7c636619ccefa41d08b1a5d72cec05f

    SHA1

    d6c25b8abdc748773585d510de5fdbc4c86804ed

    SHA256

    32b348d19a7c48d6331339cfa5318b3aa041998729fd0d9c5e641c49179d297e

    SHA512

    90c3fc5e8c55266759d76f466b2301dfdfab9d151dad5bb2c443b504732b990a1eb2d7eb735a097e6a194db4830a0e2f0c10749bbdb2b58da811d0b01b46ee0d

  • C:\Users\Admin\AppData\Local\Temp\CabEC25.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarEC47.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\nsjEAAF.tmp\4fd99101-fa18-4898-bfd9-098a5bc06f2f.exe

    Filesize

    248KB

    MD5

    22be5edcbe2fd71af6d4a98529a58d88

    SHA1

    974d22883901d75a407c46282ef75acb0187cb21

    SHA256

    c4cfe2563b9681d78283c124f49d0a627be62bd040cabeb94bfeaab2b6733e35

    SHA512

    3d3e9ba2aa4f0b67faa052d304b4186bafe539f6ae88efa38a745246e47a351607a968f8af96fc8b8d78e4cc85dcfd28f009aad47608f855588fd7530910a624

  • \Users\Admin\AppData\Local\Temp\nsjEAAF.tmp\VPatch.dll

    Filesize

    10KB

    MD5

    e7de13c3dd744f2a754553687219d39a

    SHA1

    96c5f7e23a5a49e8fe6cb7830002aad607d003e3

    SHA256

    2168f690bb1e751690a8d6922550cd86adc0762c63e9276f319116a9df910383

    SHA512

    0cd5e5343b6d893e4772c470442d8ea081d61ce38b546421a1e323cf2a0d1e2b042e009e7a14a8acb27c9d97186dd9358f5f9083dd30e9f6f41764f228febb6b

  • \Users\Admin\AppData\Local\Temp\nsjEAAF.tmp\inst.exe

    Filesize

    181KB

    MD5

    055027a390bd4d4d12dc222f50ef7886

    SHA1

    6b1777b991791ee11ce6accf8c1bdfc2342c7b55

    SHA256

    aa30d730c4608053ed0fe41ab7743d072b3afb78a710c1b5213ae7288133d3ff

    SHA512

    b307c25569d1d09341f027eb0e9e973486b8bf2ab63dfcfd36d54fdb94882393b85b395ee3d3f440197d9d821bdafda9b719d650c9b9cb658dce8b2c2750b00e

  • \Users\Admin\AppData\Local\Temp\nsjEAAF.tmp\nsExec.dll

    Filesize

    8KB

    MD5

    249ae678f0dac4c625c6de6aca53823a

    SHA1

    6ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201

    SHA256

    7298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce

    SHA512

    66e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7

  • memory/2668-120-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2688-82-0x0000000001310000-0x000000000133A000-memory.dmp

    Filesize

    168KB

  • memory/2688-84-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

    Filesize

    9.6MB

  • memory/2688-30-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

    Filesize

    9.6MB

  • memory/2688-22-0x000007FEF577E000-0x000007FEF577F000-memory.dmp

    Filesize

    4KB

  • memory/2688-110-0x000007FEF54C0000-0x000007FEF5E5D000-memory.dmp

    Filesize

    9.6MB