Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-10-2024 17:12

General

  • Target

    4e0b373a268e744d171ec51b84edb2a7_JaffaCakes118.exe

  • Size

    324KB

  • MD5

    4e0b373a268e744d171ec51b84edb2a7

  • SHA1

    d35ae3869a8f34a467a725e1f0160b01287f10fa

  • SHA256

    c4c3b4c861caf87da98a17fe58415ccd12d1a32260f34e47b3111a6cd21f7fe1

  • SHA512

    59e45e2fd14ff0c8729669b9e5c891906fdfcd42f97a69316e69058fdea4c4409d467e4cdf606da829af2dca4e21d1bcea41f35bf683ac8899a87f8c63550103

  • SSDEEP

    6144:QqbZ37OIAUuycwRfkWmqQbDTuEJy+5niz3PfcKrKywq:LZ37ORU4WNQvTMdGyn

Malware Config

Signatures

  • Renames multiple (215) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4e0b373a268e744d171ec51b84edb2a7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4e0b373a268e744d171ec51b84edb2a7_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5040
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:2764
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1408
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2288
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB45C.bat
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3396
        • C:\Users\Admin\AppData\Local\Temp\4e0b373a268e744d171ec51b84edb2a7_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\4e0b373a268e744d171ec51b84edb2a7_JaffaCakes118.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4108
      • C:\Windows\Logo1_.exe
        C:\Windows\Logo1_.exe
        2⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:2628
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1464
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:796
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4684
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1608

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\7-Zip\7z.exe.Exe

        Filesize

        631KB

        MD5

        c0a3ecbc219d7d8f904ce8a3938c0c92

        SHA1

        18fa91bd3ba3ae5ce9b1fecc4077474a32a13859

        SHA256

        b16c02cea54dc4f06597b7371486fcd5e39d7b7b08654c2bfc763a17886b90d7

        SHA512

        90e50fdb1285a44ba91db2f4e8722998dcbcf014bcb15bd280dbd9f39d5a344fcb6b4731ac0a59a084be07349557c76fb2510dd37fec51b2378aca8cd457f9ee

      • C:\Users\Admin\AppData\Local\Temp\$$aB45C.bat

        Filesize

        614B

        MD5

        03077626f4b11f9462efb3f89fd30ce3

        SHA1

        42f8be25f6e8ef1bacbe3545188d30f79a5214f0

        SHA256

        0ce2d7c95413ce39b879d3566949b5380426f5edc690720caf9a17109a3b1c62

        SHA512

        78ba875a6853398f135adcd19ab788b90dab53a5bec6bd8d8a6a82b070cfe3a7629f413031d278471513f9f583ecc19ebe9b30fa233984bbf42870983d7c72f9

      • C:\Users\Admin\AppData\Local\Temp\4e0b373a268e744d171ec51b84edb2a7_JaffaCakes118.exe.exe

        Filesize

        237KB

        MD5

        eaa0aa6d309d31632f08ccfa42043730

        SHA1

        409e6aeb82ae337475994fe76c46b1e69014d39c

        SHA256

        71bff7ce0006bc845e4eb1680fad9687127722f17d15044d8bdf59b693d21c04

        SHA512

        2fab691a2cee34936dabd14130baab5825ba5d1607d2283cd5940a5d6a22c38d4a7f7daf48f959f2403a922766b94a7e5005b82613e709504b0ed8c43b55c43a

      • C:\Users\Admin\AppData\Local\Temp\b5soet.dll

        Filesize

        23KB

        MD5

        1e9bfb0d105dc2e2afaa14741bd4c692

        SHA1

        1eaaf954683b6c796226226ebdc84d91d6650499

        SHA256

        035ca07795b691cc920358767f1eae2921756ba75739637e3f9411866c0db19f

        SHA512

        3c1f5a5330d4cf16d99cf1956871d5eb017d5951e79404d9dde1f9740935280305eb5cb1f2fa4c02da7d6f2a8c040daf49cc2da7a34f7a484ba83b01b7d72073

      • C:\Windows\Logo1_.exe

        Filesize

        87KB

        MD5

        3eb732a76eaab2e56b1ac4d2ef756bfc

        SHA1

        6308814ebc92dac58e3b90e6bfdd3f15ff8f4c1c

        SHA256

        9ab09633bd1cc801dae739ec4220964838c2f1e83f6443af2acc7be6bd3b6d4d

        SHA512

        520c2b3f21f153fa5ad9f776bd96466e2816e94b18633a827bc6b80f2a0293d6264b75fffa52cd5f748c3ce84b89136ace3d68b2c2096242782471e12bf3fdc4

      • C:\Windows\system32\drivers\etc\hosts

        Filesize

        842B

        MD5

        6f4adf207ef402d9ef40c6aa52ffd245

        SHA1

        4b05b495619c643f02e278dede8f5b1392555a57

        SHA256

        d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e

        SHA512

        a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47

      • memory/4004-19-0x0000000000400000-0x000000000044B000-memory.dmp

        Filesize

        300KB

      • memory/4004-36-0x0000000000400000-0x000000000044B000-memory.dmp

        Filesize

        300KB

      • memory/4004-37-0x0000000010000000-0x0000000010016000-memory.dmp

        Filesize

        88KB

      • memory/5040-20-0x0000000000400000-0x000000000044B000-memory.dmp

        Filesize

        300KB

      • memory/5040-21-0x0000000010000000-0x0000000010016000-memory.dmp

        Filesize

        88KB

      • memory/5040-0-0x0000000000400000-0x000000000044B000-memory.dmp

        Filesize

        300KB

      • memory/5040-9-0x0000000000520000-0x0000000000540000-memory.dmp

        Filesize

        128KB

      • memory/5040-6-0x0000000000540000-0x0000000000560000-memory.dmp

        Filesize

        128KB

      • memory/5040-5-0x0000000010000000-0x0000000010016000-memory.dmp

        Filesize

        88KB