Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 01:26

General

  • Target

    2869d3293fbd9b23e808bb2848c0e5ff_JaffaCakes118.exe

  • Size

    298KB

  • MD5

    2869d3293fbd9b23e808bb2848c0e5ff

  • SHA1

    841339db39ae52e36343ba2725db4eb186e8034d

  • SHA256

    e1e9198098478ec6d013f8bf44a3368022cb7f5609367a97216a639d6c620480

  • SHA512

    ef3eb8f77764e3b01bedfac40bd1afe9f7a91195dcbf003d40a86e29e00c3e1423378ebf8c9fd37f76308c1e9e66b329d867156ab29e180d5b209e735111a859

  • SSDEEP

    6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYr:v6Wq4aaE6KwyF5L0Y2D1PqLM

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 16 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2869d3293fbd9b23e808bb2848c0e5ff_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2869d3293fbd9b23e808bb2848c0e5ff_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Windows\svhost.exe
      C:\Windows\svhost.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3284

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\PerfLogs.exe

          Filesize

          298KB

          MD5

          bb5590383a4e77e9bde3f8f3907cefb6

          SHA1

          56eee06afda9623354b4c1315f107a159e3dc18c

          SHA256

          cf5d19328e8af17184fde0487a9620bd1ac8c52b604a6d964dd6e446580d469a

          SHA512

          bda92acecf2faede82ac4be81b102c5e7f8a70a94229ad379583a0c92b45a29e6df303a1887cd3224a94c7957f3507147b51985b2e9e85789ada2b2f7343e690

        • C:\Windows\Driver.db

          Filesize

          82B

          MD5

          c2d2dc50dca8a2bfdc8e2d59dfa5796d

          SHA1

          7a6150fc53244e28d1bcea437c0c9d276c41ccad

          SHA256

          b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960

          SHA512

          6cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4

        • C:\Windows\svhost.exe

          Filesize

          298KB

          MD5

          87841ced6be8fdc94a92582fe1eb727a

          SHA1

          9a87e7278958260470ec9144fa63c4c60c6fa8c3

          SHA256

          187cb6930986e2146d62ea99d4816f283cf0271c53154e5c26b9eaf1567d3d37

          SHA512

          0ec1b24a98f19d5756ee2af8917e1b9fb0f3d6cff53cb385cd1226e9c779d012c349a88a5f013363b0bce16e4766d788c861c2c5785b9ebba23b616c1713f93d

        • memory/2744-0-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/2744-768-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-5660-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-7939-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-2257-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-3401-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-4534-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-1127-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-6798-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-1131-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-9074-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-10209-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-11347-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-12482-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-13496-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-14638-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

        • memory/3284-15772-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB