Analysis

  • max time kernel
    145s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-10-2024 03:01

General

  • Target

    600afc997d421b9ed14064b2759879de_JaffaCakes118.exe

  • Size

    182KB

  • MD5

    600afc997d421b9ed14064b2759879de

  • SHA1

    3f83c2c1b304b7269fdd2bf6963b738ca19c74b3

  • SHA256

    bf6acb4359d2cc3d8ee27fb9093bcbb478dcdb919a5a05dcf80039aa21c811bb

  • SHA512

    1ff25a2ec275197e5177ab5331eb5cd3eced7f40908d33f643e292fc051885cc6d6b16d1397ed0cab7acce25d8165ef134d1b5b94aafd5b1ab30e5b2df0d353e

  • SSDEEP

    3072:rimsXXK9HRTOeriRfP6pXfSb0dspqc5oY0htVFAHT11Ual21Cxcs0HKAH057kyJ9:riMmXRH6pXfSb0ceR/VFAHh1kgcs0HWf

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 31 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\600afc997d421b9ed14064b2759879de_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\600afc997d421b9ed14064b2759879de_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2544
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.exe

    Filesize

    183KB

    MD5

    5965e6a105ffb1cf34657e7cd142393e

    SHA1

    3bdc31bc78d468b338f3bee9e5fb4f91716c5a52

    SHA256

    a826d0ab38a3297bdf87846abc6beb7fa9a80b91e15f64f74592ed8011781569

    SHA512

    55ebc7347f1e477f9421979852ec22f81907a3c13f3a21466412bf97e974e0b2d0afdc9c343d345bcf813c1de019f157b3d4c07eb9ef014642c918e7656556f4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    2146c48d7fec3978c9a5d48a05e7bfa8

    SHA1

    6244e6a22c649012be78135c6668fa037fc21441

    SHA256

    026206717600f8cb2c6e1be95df417628a703f3684598ee1ef84ed2464467037

    SHA512

    723a3246672f839e6aa8737122f2154249931e584c91de831151f6b2f819de8f2de1aad68af6b33a3beff22d9f85275c5898ad768c448e6729946cbc67890fcc

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    950B

    MD5

    04c202d5aedc1521efeac1e387323963

    SHA1

    89fdc10b0bc37ba4bb3d77a0a40779de1be6156c

    SHA256

    8df05738ab0c1fa81b918a437d00bf1342ae0182a1dd4bd8687a6754f90ad332

    SHA512

    b1b8620da01f8b54e4d7488485ba0565c0f2aa5e2c47f7c55fa5bca3d4b44821f49b86658ca70a25b5276712aebcb03484804ed34b00b28a32bae28205d3ff8e

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    182KB

    MD5

    600afc997d421b9ed14064b2759879de

    SHA1

    3f83c2c1b304b7269fdd2bf6963b738ca19c74b3

    SHA256

    bf6acb4359d2cc3d8ee27fb9093bcbb478dcdb919a5a05dcf80039aa21c811bb

    SHA512

    1ff25a2ec275197e5177ab5331eb5cd3eced7f40908d33f643e292fc051885cc6d6b16d1397ed0cab7acce25d8165ef134d1b5b94aafd5b1ab30e5b2df0d353e

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    182KB

    MD5

    5d112b6fdd48b412d4b24ece28eccff8

    SHA1

    0750b253cc5b881633bda691d527d39bc20fe993

    SHA256

    884bca3eb7d1121320baae9f5f5d30a102d5a62d42ce958979318ec687af00da

    SHA512

    1cefbfc316692bf0cb1ae4d60617c889cf76021bf2cd7299030b6fe92ba89b96204faec607f6d0ab4b73d95d8671939470672cd28e226ec728f05aa1a63556b5

  • memory/1684-275-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1684-306-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1684-9-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/1684-368-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1684-237-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/1684-236-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1684-364-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1684-249-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1684-358-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1684-261-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1684-352-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1684-346-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1684-335-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1684-287-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1684-323-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1684-299-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-260-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2544-298-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-319-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-334-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-286-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-345-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-305-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-351-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-274-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-357-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-229-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2544-363-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-248-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-367-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2544-235-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB