Analysis

  • max time kernel
    140s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 07:54

General

  • Target

    2d95eaa898c7c653be7fe5ad8a8bb394_JaffaCakes118.exe

  • Size

    1.7MB

  • MD5

    2d95eaa898c7c653be7fe5ad8a8bb394

  • SHA1

    f42293cb82ff3a7f9491b9a2498fd15a4144c407

  • SHA256

    5224e77e3662f69ae1f554ef4737301567411803828355e0718945ecc7f3d6fd

  • SHA512

    b74b177c014d47112f2f236e27b1d8f81ab60255758c12dbb22b07d6d0f4337fc51b3484ad4c87c42d124ae1510f5d4e1e826b17b6cbb90e5ca45b45042f88a3

  • SSDEEP

    49152:V6tGner/kIzUBDDExDf29HZjbDLnZc9NH3:4tGe7nmINOV1tcbX

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1188
      • C:\Users\Admin\AppData\Local\Temp\2d95eaa898c7c653be7fe5ad8a8bb394_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\2d95eaa898c7c653be7fe5ad8a8bb394_JaffaCakes118.exe"
        2⤵
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2968
        • C:\Windows\WINDOWS\system.exe
          C:\Windows\WINDOWS\system.exe
          3⤵
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2656

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Windows\WINDOWS\install.sys

      Filesize

      218KB

      MD5

      90f1d356cd7b40db6b538d867f76f4a1

      SHA1

      19a9a526ce6cde8af05868cc2c4a1ff215a2d5d9

      SHA256

      2ab20880df3c26d899fbdb9f093636cebf25c55c826aa8a6838b3de32148c959

      SHA512

      e47dfb7b21f93dcdb500d42f0a11f85e2c3dd1bdff566ecb8ca9ab69904934f4aa5c4cfdaae820f33796652bf6e32783e7797bb16861b25bc5c7a2006aebc0e9

    • \Windows\WINDOWS\system.exe

      Filesize

      1.7MB

      MD5

      2d95eaa898c7c653be7fe5ad8a8bb394

      SHA1

      f42293cb82ff3a7f9491b9a2498fd15a4144c407

      SHA256

      5224e77e3662f69ae1f554ef4737301567411803828355e0718945ecc7f3d6fd

      SHA512

      b74b177c014d47112f2f236e27b1d8f81ab60255758c12dbb22b07d6d0f4337fc51b3484ad4c87c42d124ae1510f5d4e1e826b17b6cbb90e5ca45b45042f88a3

    • memory/1188-12-0x00000000025C0000-0x00000000025C1000-memory.dmp

      Filesize

      4KB

    • memory/2656-31-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-34-0x0000000004450000-0x00000000044A6000-memory.dmp

      Filesize

      344KB

    • memory/2656-16-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-18-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-26-0x0000000004450000-0x0000000004460000-memory.dmp

      Filesize

      64KB

    • memory/2656-24-0x0000000004450000-0x00000000044A6000-memory.dmp

      Filesize

      344KB

    • memory/2656-56-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-27-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-28-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-29-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-30-0x0000000004450000-0x00000000044A6000-memory.dmp

      Filesize

      344KB

    • memory/2656-54-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-33-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-52-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-35-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-37-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-39-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-42-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-44-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-46-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-48-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2656-50-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2968-5-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2968-0-0x0000000013140000-0x0000000013324000-memory.dmp

      Filesize

      1.9MB

    • memory/2968-1-0x0000000013141000-0x0000000013146000-memory.dmp

      Filesize

      20KB