Analysis

  • max time kernel
    140s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 16:07

General

  • Target

    837d9aa98734a8157427db992ec652b1_JaffaCakes118.exe

  • Size

    289KB

  • MD5

    837d9aa98734a8157427db992ec652b1

  • SHA1

    8f882a7e3594de8eb35c4ba953b0159a51de49af

  • SHA256

    bb2a92ec461dba24f99e11146ac279a1a7abc5fcdfa784ab6f063b18e89aadf5

  • SHA512

    ce1642beaad5f3fd86d4d8b5832840ce1f08d631cb9083d09e67c3f0016a1f3a302355410e428d3bf331cece50f1e697af1a86a81e5c822d288804eab83aad6e

  • SSDEEP

    6144:C5O8bUSO/9xxY3hkm1ZDLZA3M7KrD37lSCVzhhy6:TGOYGmvLZA3M7KrDJVF

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 32 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\837d9aa98734a8157427db992ec652b1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\837d9aa98734a8157427db992ec652b1_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe
      "C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1692

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe

          Filesize

          227KB

          MD5

          006bcf6d8e9bcda4ad8323f3622e245b

          SHA1

          45b88bd752ea8853a3aebf5779ae47666253251c

          SHA256

          8854b97a765d20e2f15cc2da23bd78584bc3f67ec05a7e3f16020690f25d3821

          SHA512

          4008fbce2719618acd2a4f852a601517935a018f56ff361c4c08a88fb1446f2e35652c8128ed86b313bd198966ffb8892c6ee7000132551d396dbcb40ba48ec0

        • C:\Users\Admin\AppData\Local\Temp\nsa6EF7.tmp\System.dll

          Filesize

          11KB

          MD5

          00a0194c20ee912257df53bfe258ee4a

          SHA1

          d7b4e319bc5119024690dc8230b9cc919b1b86b2

          SHA256

          dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

          SHA512

          3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

        • C:\Users\Admin\AppData\Local\Temp\nsa6EF7.tmp\inetc.dll

          Filesize

          20KB

          MD5

          8d8fdad7e153d6b82913f6fdc407d12c

          SHA1

          aabbeed33cd5221e4cb22aab6e48310df94facfd

          SHA256

          e727c8bba6686c4814602f2bc089af4b4cf3498d1dbe1a08d8c4732da5ba046b

          SHA512

          42bc0ce1aca63904c34025307fd4b1d9f480ae47e42e7dfa48bbbf8286d947de2989435ad7a748951291307949217afeebcd31d10a1356c9366d3187085773a2

        • C:\Users\Admin\AppData\Local\Temp\nsa6EF7.tmp\md5dll.dll

          Filesize

          8KB

          MD5

          a7d710e78711d5ab90e4792763241754

          SHA1

          f31cecd926c5d497aba163a17b75975ec34beb13

          SHA256

          9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2

          SHA512

          f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0

        • memory/1692-19-0x0000000000400000-0x00000000004AB000-memory.dmp

          Filesize

          684KB

        • memory/1692-31-0x0000000000400000-0x00000000004AB000-memory.dmp

          Filesize

          684KB

        • memory/1692-33-0x0000000000400000-0x00000000004AB000-memory.dmp

          Filesize

          684KB