Analysis

  • max time kernel
    140s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2024, 22:06

General

  • Target

    4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe

  • Size

    264KB

  • MD5

    4a3abd92faaeee0cbf47648b9f235140

  • SHA1

    8b23873bc42746c2cdcc295dd221e07ddd27e177

  • SHA256

    ab085e99a17a68e32f9c530278cf8a997ca9b7a9a9c3b951256acc37be5f6322

  • SHA512

    940c33c3332d3d56b76fe0eab8545f801258caf58f7acaaaa6fabc1291efefc4179334390b76ab6a8a81452cf9a244d8e76b4768761769d7292ac64f35520a50

  • SSDEEP

    6144:W5O8rS69xxY3hkm1ZDLZA3M7KrD37lSCVzhhy7:HBhGmvLZA3M7KrDJVI

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 19 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe
      "C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1116

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe

          Filesize

          227KB

          MD5

          006bcf6d8e9bcda4ad8323f3622e245b

          SHA1

          45b88bd752ea8853a3aebf5779ae47666253251c

          SHA256

          8854b97a765d20e2f15cc2da23bd78584bc3f67ec05a7e3f16020690f25d3821

          SHA512

          4008fbce2719618acd2a4f852a601517935a018f56ff361c4c08a88fb1446f2e35652c8128ed86b313bd198966ffb8892c6ee7000132551d396dbcb40ba48ec0

        • C:\Users\Admin\AppData\Local\Temp\nsbAF4C.tmp\System.dll

          Filesize

          11KB

          MD5

          00a0194c20ee912257df53bfe258ee4a

          SHA1

          d7b4e319bc5119024690dc8230b9cc919b1b86b2

          SHA256

          dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

          SHA512

          3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

        • C:\Users\Admin\AppData\Local\Temp\nsbAF4C.tmp\inetc.dll

          Filesize

          20KB

          MD5

          8d8fdad7e153d6b82913f6fdc407d12c

          SHA1

          aabbeed33cd5221e4cb22aab6e48310df94facfd

          SHA256

          e727c8bba6686c4814602f2bc089af4b4cf3498d1dbe1a08d8c4732da5ba046b

          SHA512

          42bc0ce1aca63904c34025307fd4b1d9f480ae47e42e7dfa48bbbf8286d947de2989435ad7a748951291307949217afeebcd31d10a1356c9366d3187085773a2

        • C:\Users\Admin\AppData\Local\Temp\nsbAF4C.tmp\md5dll.dll

          Filesize

          8KB

          MD5

          a7d710e78711d5ab90e4792763241754

          SHA1

          f31cecd926c5d497aba163a17b75975ec34beb13

          SHA256

          9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2

          SHA512

          f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0

        • memory/1116-11-0x0000000000400000-0x00000000004AB000-memory.dmp

          Filesize

          684KB

        • memory/1116-30-0x0000000000400000-0x00000000004AB000-memory.dmp

          Filesize

          684KB

        • memory/1116-32-0x0000000000400000-0x00000000004AB000-memory.dmp

          Filesize

          684KB