Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05-10-2024 08:02

General

  • Target

    16d8771f5afb389389946b130e50c429_JaffaCakes118.exe

  • Size

    386KB

  • MD5

    16d8771f5afb389389946b130e50c429

  • SHA1

    0b5b0ff27ed426e53d0b2298c9556f03913d9a3e

  • SHA256

    63478a65e1b3a5863c4eb8b746b1cc5fe4e81a79790b01f9004c4cf9071d9756

  • SHA512

    068e4e383a3813035e78ad7e5cc79f05cfcbbcdd4236b53615ebfe102bdfadc393da779b7f976abed62a7ab0a1cba5988216f3b8220b5328efea892d0889e254

  • SSDEEP

    12288:2N8tvkTTGy6p/11wtrwWCxqE5/MZcosIo:2N8OP1q0wpxqE1gTo

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16d8771f5afb389389946b130e50c429_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\16d8771f5afb389389946b130e50c429_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\ProgramData\fP01842FeLpO01842\fP01842FeLpO01842.exe
      "C:\ProgramData\fP01842FeLpO01842\fP01842FeLpO01842.exe" "C:\Users\Admin\AppData\Local\Temp\16d8771f5afb389389946b130e50c429_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\fP01842FeLpO01842\fP01842FeLpO01842

    Filesize

    192B

    MD5

    bf7dec9585ba7676efa0bca5dbdf822e

    SHA1

    82267e4cba56449072ba50459f396b254a1ed0b1

    SHA256

    7880408997811333df11f19d714208cbe0ab2e4c3f19d0c1a80fee02b1f596f5

    SHA512

    79c08293e2bbfacfb4a536617c5ddeb939472ed0bded167a424174af9c90098a6e9593db67ca67d39a12546865d51274cba1cba2eb8ce9fe881d2aeed2f32c4c

  • \ProgramData\fP01842FeLpO01842\fP01842FeLpO01842.exe

    Filesize

    386KB

    MD5

    f80fc20a7a1bad808b8ff8b482742a70

    SHA1

    23984f1eafe380011888ca9af34ee28ece804a94

    SHA256

    b9d6090aef6fab162239ce1a1f12f117e8a570cf2f0a167a7b8b3bbc186cb652

    SHA512

    3a23960484b14f6ad511a13c4e2bb4e57e7ddd50ae1ffe588e9c2985ecfc386a1bff9a957acee19395a9b8a5bcfb20b7ca4ef7af50ba721b445738f1e26de5d3

  • memory/2384-0-0x00000000003F0000-0x00000000003F2000-memory.dmp

    Filesize

    8KB

  • memory/2384-1-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/2384-17-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/2860-19-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/2860-25-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/2860-29-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/2860-37-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/2860-39-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB