Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/01/2025, 16:33

General

  • Target

    JaffaCakes118_5c4bc26caed4fbeca8026e18b58eb0d9.exe

  • Size

    556KB

  • MD5

    5c4bc26caed4fbeca8026e18b58eb0d9

  • SHA1

    b325151aa6e6ba2155c4b81e51fa36aea9e62588

  • SHA256

    6985bcee389298aeeb0fdf6067f48749c309cd97750d41dfb192f4cfbc96b54b

  • SHA512

    992131fa20161a0a22fdc1fb0d7e34fb268aa7aedce9c7e6a2ff5501edea01447ab77b926323733413ad74d133d4d1eee78f4ae2fa4dc404891af2fd749e4c10

  • SSDEEP

    12288:I9cONi+mj169epUzdmpN2aAbFc0G+lZs8EmShYPtZww4M76kSA4drG:YvNi+m1Oz4po5c0G+lefJhY/wW7ZAQ

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 20 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c4bc26caed4fbeca8026e18b58eb0d9.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c4bc26caed4fbeca8026e18b58eb0d9.exe"
    1⤵
    • Loads dropped DLL
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:640
  • C:\Windows\SysWOW64\odbctrac32.exe
    C:\Windows\SysWOW64\odbctrac32.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4492
    • C:\ProgramData\agentactivationruntimewindows32.exe
      schutz
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2432

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\974975309

          Filesize

          34B

          MD5

          71723132c62124e5dd0d4e39bc72ece8

          SHA1

          338a09b62eea797f4335cf6019fbfdbaa410997d

          SHA256

          0d33358e318803c05f591c107ca9d8575635ccffcf3b33cfe5c44168ee5756de

          SHA512

          fc8827b5b1887127be940bf01e2db816f1a60263830e0b916e92e27f9c6a23b56bb0035004297778fe5a6554d5686cbb4894205b59a3f32a90bcd67eb1157baa

        • C:\Windows\SysWOW64\974975309

          Filesize

          84B

          MD5

          3670d2494d8baec069f3a068668fd463

          SHA1

          1a68de1762b920fbe19385fb3d1a262a30bb1ceb

          SHA256

          1451f3e2dca6c70601925d813f52b7c84988c702ccb2c07c57a598126a23ea56

          SHA512

          9ef097bd95428bff95d3a9cfb0f93538d664f9908e74420980ba5fe289fefcb78f19349d2dabe7d907c1614c112d5a5355dccfcc82466eb9f6813adec49ac74c

        • C:\Windows\SysWOW64\agentactivationruntimewindows32.dll

          Filesize

          349KB

          MD5

          039a15a688868e70e8f524dd085de889

          SHA1

          696707392807a8a12a186eace7f2988fa99d0410

          SHA256

          9df4737585de117e0de9b51cc4c047caf818cd3568c94b87a003a40ad99992fa

          SHA512

          8e6c40cf4241cf66adf0bd0cd5efb8621b92b2c444e3ec20daa02b36268a5aa9a70577ef8d480e3b6fea7b72f9c31657cddf5d4d652bc2403637dbdb9d0decd7

        • C:\Windows\SysWOW64\odbctrac32.exe

          Filesize

          556KB

          MD5

          5c4bc26caed4fbeca8026e18b58eb0d9

          SHA1

          b325151aa6e6ba2155c4b81e51fa36aea9e62588

          SHA256

          6985bcee389298aeeb0fdf6067f48749c309cd97750d41dfb192f4cfbc96b54b

          SHA512

          992131fa20161a0a22fdc1fb0d7e34fb268aa7aedce9c7e6a2ff5501edea01447ab77b926323733413ad74d133d4d1eee78f4ae2fa4dc404891af2fd749e4c10

        • memory/640-6-0x0000000010000000-0x000000001008F000-memory.dmp

          Filesize

          572KB

        • memory/640-10-0x0000000000400000-0x0000000000492000-memory.dmp

          Filesize

          584KB

        • memory/640-0-0x0000000000489000-0x000000000048C000-memory.dmp

          Filesize

          12KB

        • memory/640-31-0x0000000000400000-0x0000000000492000-memory.dmp

          Filesize

          584KB

        • memory/640-30-0x0000000000489000-0x000000000048C000-memory.dmp

          Filesize

          12KB

        • memory/640-1-0x0000000000400000-0x0000000000492000-memory.dmp

          Filesize

          584KB

        • memory/2432-38-0x0000000000400000-0x0000000000492000-memory.dmp

          Filesize

          584KB

        • memory/2432-42-0x0000000000400000-0x0000000000492000-memory.dmp

          Filesize

          584KB

        • memory/4492-27-0x0000000000400000-0x0000000000492000-memory.dmp

          Filesize

          584KB

        • memory/4492-40-0x0000000000400000-0x0000000000492000-memory.dmp

          Filesize

          584KB