Analysis

  • max time kernel
    140s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2024, 01:14

General

  • Target

    159a037a37339a28dfbf8af93f3efdeb_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    159a037a37339a28dfbf8af93f3efdeb

  • SHA1

    17bf99c8c7b97385773ccf1b186a9eea9e74fdac

  • SHA256

    cec0150ad1e839c303bfff7282abe1d1385fa455141f19c46358a8977bff8513

  • SHA512

    ff56a732d5d8269791a589401bb498d80d56f906675c2c5620aec4f13682ea8ab40e4b9433f00d09f9e37dc7dfa30ed82b73964aed56134a36781c163d9f3f0f

  • SSDEEP

    12288:NceA/yvZlvENoBh/LzN4V2BDBFmszSjY:aeZlMNoBXeeCszS

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\159a037a37339a28dfbf8af93f3efdeb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\159a037a37339a28dfbf8af93f3efdeb_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Documents and Settings\Administrator\¡¸¿ªÊ¼¡¹²Ëµ¥\³ÌÐò\Æô¶¯\360.exe
      "C:\Documents and Settings\Administrator\¡¸¿ªÊ¼¡¹²Ëµ¥\³ÌÐò\Æô¶¯\360.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5000
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        3⤵
          PID:2584
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
        2⤵
        • System Location Discovery: System Language Discovery
        PID:5036

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Administrator\¡¸¿ªÊ¼¡¹²Ëµ¥\³ÌÐò\Æô¶¯\360.exe

      Filesize

      1.3MB

      MD5

      159a037a37339a28dfbf8af93f3efdeb

      SHA1

      17bf99c8c7b97385773ccf1b186a9eea9e74fdac

      SHA256

      cec0150ad1e839c303bfff7282abe1d1385fa455141f19c46358a8977bff8513

      SHA512

      ff56a732d5d8269791a589401bb498d80d56f906675c2c5620aec4f13682ea8ab40e4b9433f00d09f9e37dc7dfa30ed82b73964aed56134a36781c163d9f3f0f

    • C:\Windows\uninstal.bat

      Filesize

      218B

      MD5

      144d7d1d50a4f9d6178277d3eefe9898

      SHA1

      3fa3eb446878fce967122cd2e469c133848d4ca7

      SHA256

      584dd65605cdca417ca139b7c458bf695f227d959cfe97c136d608af3a7334ca

      SHA512

      41faaec83f4bec22bdc013201f62ee1bfcb906cd8013cda3536e5587395d1cba2fb0992098e32cd793a1dcfee0e363fadb4fdffc9f287e5571c638c93d3ba515

    • memory/4760-0-0x0000000000400000-0x000000000054E000-memory.dmp

      Filesize

      1.3MB

    • memory/4760-1-0x0000000000800000-0x0000000000801000-memory.dmp

      Filesize

      4KB

    • memory/4760-10-0x0000000000400000-0x000000000054E000-memory.dmp

      Filesize

      1.3MB

    • memory/5000-7-0x0000000000650000-0x0000000000651000-memory.dmp

      Filesize

      4KB

    • memory/5000-12-0x0000000000400000-0x000000000054E000-memory.dmp

      Filesize

      1.3MB

    • memory/5000-14-0x0000000000650000-0x0000000000651000-memory.dmp

      Filesize

      4KB