Analysis

  • max time kernel
    148s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-11-2024 05:13

General

  • Target

    b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe

  • Size

    1.4MB

  • MD5

    b4f058ff3a9b018dff2d84422836e3f3

  • SHA1

    2df2e6982a1171cf932956beb17db2e8214ff17d

  • SHA256

    fb02d3051ba425240d34d9fe6901a48056a252948a55d1a2d40b1c81110e3ac3

  • SHA512

    54708ae21f648103c37faeea506fdf8744018187e6d1bcf46d305680bf6a9a958fcf1d3dba42f0911306547d1ab0802d0d0febff32f9581e4aef6ec4527e9b10

  • SSDEEP

    24576:ZUZaCTSu1iAjb/GCh2qWq+dl+vYurClThCob2FJLc5bSr5uhNY+jAAY:CFFjb/VEtwClcFRcaMNjI

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 19 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1836
        • C:\Users\Admin\AppData\Local\Temp\a.exe
          "C:\Users\Admin\AppData\Local\Temp\a.exe"
          3⤵
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1892
          • C:\Users\Admin\AppData\Local\Temp\a.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2928
            • C:\Users\Admin\AppData\Roaming\avast.exe
              "C:\Users\Admin\AppData\Roaming\avast.exe" \melt "C:\Users\Admin\AppData\Local\Temp\a.exe"
              5⤵
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2652
              • C:\Users\Admin\AppData\Roaming\avast.exe
                6⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1984
                • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Roaming\avast.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of FindShellTrayWindow
                  PID:1528

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\a.exe

      Filesize

      636KB

      MD5

      6eaf5e82d7c9a1bfaca0cd0763567419

      SHA1

      e1014a11e31b770d633ee5afe6bdf2cdd19b4cda

      SHA256

      c52947ccd078559ad020a960e8701d609fc24547965a03ae8e2272d547643254

      SHA512

      01eb2fc379fac5d828a47f24e17de462226ff4ff6b198e603d41901495256d5780df1edf1776cf2b34ad57f26953222567d9ebbd19996d280519500d56bc1ad5

    • memory/1836-12-0x0000000003380000-0x0000000003428000-memory.dmp

      Filesize

      672KB

    • memory/1836-11-0x0000000003380000-0x0000000003428000-memory.dmp

      Filesize

      672KB

    • memory/1892-22-0x0000000000400000-0x00000000004A8000-memory.dmp

      Filesize

      672KB

    • memory/1892-27-0x0000000000310000-0x0000000000321000-memory.dmp

      Filesize

      68KB

    • memory/1892-26-0x0000000000310000-0x0000000000321000-memory.dmp

      Filesize

      68KB

    • memory/1892-25-0x0000000000310000-0x0000000000321000-memory.dmp

      Filesize

      68KB

    • memory/1892-24-0x0000000000310000-0x0000000000321000-memory.dmp

      Filesize

      68KB

    • memory/1892-23-0x0000000000310000-0x0000000000321000-memory.dmp

      Filesize

      68KB

    • memory/1892-32-0x0000000000400000-0x00000000004A8000-memory.dmp

      Filesize

      672KB

    • memory/1892-31-0x0000000000401000-0x0000000000420000-memory.dmp

      Filesize

      124KB

    • memory/1892-29-0x0000000000330000-0x0000000000368000-memory.dmp

      Filesize

      224KB

    • memory/1892-28-0x0000000000330000-0x0000000000368000-memory.dmp

      Filesize

      224KB

    • memory/1892-56-0x0000000000310000-0x0000000000321000-memory.dmp

      Filesize

      68KB

    • memory/1892-61-0x0000000000401000-0x0000000000420000-memory.dmp

      Filesize

      124KB

    • memory/1892-60-0x0000000000330000-0x0000000000368000-memory.dmp

      Filesize

      224KB

    • memory/1892-59-0x0000000000400000-0x00000000004A8000-memory.dmp

      Filesize

      672KB

    • memory/2652-101-0x0000000000400000-0x00000000004A8000-memory.dmp

      Filesize

      672KB

    • memory/2652-119-0x0000000002590000-0x0000000002638000-memory.dmp

      Filesize

      672KB

    • memory/2652-115-0x0000000000950000-0x0000000000988000-memory.dmp

      Filesize

      224KB

    • memory/2652-114-0x0000000000930000-0x0000000000941000-memory.dmp

      Filesize

      68KB

    • memory/2652-154-0x0000000000400000-0x00000000004A8000-memory.dmp

      Filesize

      672KB

    • memory/2652-110-0x00000000008A0000-0x0000000000948000-memory.dmp

      Filesize

      672KB

    • memory/2652-111-0x0000000000930000-0x0000000000941000-memory.dmp

      Filesize

      68KB

    • memory/2652-112-0x0000000000930000-0x0000000000941000-memory.dmp

      Filesize

      68KB

    • memory/2652-113-0x0000000000930000-0x0000000000941000-memory.dmp

      Filesize

      68KB

    • memory/2928-85-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-46-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-83-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-81-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-79-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-77-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-75-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-73-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-71-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-69-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-67-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-50-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2928-48-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-87-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-44-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-42-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-40-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-38-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-36-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-92-0x0000000003500000-0x0000000003510000-memory.dmp

      Filesize

      64KB

    • memory/2928-86-0x0000000000420000-0x00000000004C8000-memory.dmp

      Filesize

      672KB

    • memory/2928-64-0x0000000000420000-0x00000000004C8000-memory.dmp

      Filesize

      672KB

    • memory/2928-52-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-54-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-55-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2928-102-0x0000000003600000-0x00000000036A8000-memory.dmp

      Filesize

      672KB

    • memory/2928-100-0x0000000003600000-0x00000000036A8000-memory.dmp

      Filesize

      672KB

    • memory/2928-105-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB