Analysis

  • max time kernel
    134s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 02:19

General

  • Target

    812d65463c94917fd6deb8412cf8f077_JaffaCakes118.exe

  • Size

    15KB

  • MD5

    812d65463c94917fd6deb8412cf8f077

  • SHA1

    b9b1f7c74c54412ce8b29ad638136e2c68958af4

  • SHA256

    dd25e2b04f687fadb772a66715789581648e8d959175e46a736aadb208d86af1

  • SHA512

    b21b6380bade37f2052bdc3e3b8f32d4be8d2f54f697330bdeb7abe83bc348403048bde8d35a2e35d801d52eca42ebf82cb039b526ea6be41225fa46665e4769

  • SSDEEP

    384:er955IfBEgvj/mV8ruxpOwFAVc2JUApGvmS4SEzvIFZdshzMgB9:e55oL/mV8rusqUc+MvmSHLv+MgB9

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in Program Files directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3416
      • C:\Users\Admin\AppData\Local\Temp\812d65463c94917fd6deb8412cf8f077_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\812d65463c94917fd6deb8412cf8f077_JaffaCakes118.exe"
        2⤵
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3856
        • C:\Program Files\NetMeeting\ravmsmon.exe
          "C:\Program Files\NetMeeting\ravmsmon.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2412
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\812d65463c94917fd6deb8412cf8f077_JaffaCakes118.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5056

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\NetMeeting\ravmsmon.exe

            Filesize

            15KB

            MD5

            812d65463c94917fd6deb8412cf8f077

            SHA1

            b9b1f7c74c54412ce8b29ad638136e2c68958af4

            SHA256

            dd25e2b04f687fadb772a66715789581648e8d959175e46a736aadb208d86af1

            SHA512

            b21b6380bade37f2052bdc3e3b8f32d4be8d2f54f697330bdeb7abe83bc348403048bde8d35a2e35d801d52eca42ebf82cb039b526ea6be41225fa46665e4769