Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2024, 20:17

General

  • Target

    49d01a61cf81e426ddf6a7b986c45ea6_JaffaCakes118.exe

  • Size

    40KB

  • MD5

    49d01a61cf81e426ddf6a7b986c45ea6

  • SHA1

    2013051a76127fd2ea1f23658d6434a1793bc597

  • SHA256

    a33b1a0e0b70ee3c311717bdfe0ff5ffb85d3160186f595c48b4b49c51c563f2

  • SHA512

    e61f2e2e5f0873cb4699ce00e009c8aaa3503c3ca069d52b0bf65e090e88d09fbe813ca04782b928d21d67ce97d50f074435e0d8ed9b74a92f164f64169c79e6

  • SSDEEP

    768:mOh/vqegpGUTO4pLLro4aPqHtHj5PHfDUk0AV:mSvYOwLLro4aC5PHLUkx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49d01a61cf81e426ddf6a7b986c45ea6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\49d01a61cf81e426ddf6a7b986c45ea6_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\smss.exe
      "C:\smss.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2108

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\smss.exe

          Filesize

          44KB

          MD5

          58e4a5b93a533b88d14a4356b975b6ff

          SHA1

          7ab82768fd4556f3037f7258e02f5bbcbb1a1e1c

          SHA256

          f09da3978ebc8a1293b5aeb4b94598d1370f79ac393cb2671fb50c15a326dc45

          SHA512

          9ac69f521d6f54c0372869863a0e6582955723e0cfb5a24eec9557cdb3f11317cbadea7143e810e6a17cb1f30923bfca4d4adae780f396c7328408fa176c66f5