Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2025, 20:34

General

  • Target

    JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe

  • Size

    104KB

  • MD5

    437298c4fbec9e4ef812f7324ffaf4b6

  • SHA1

    4468814c74f41a69d7cbc73c0e80edb02889c1f6

  • SHA256

    c1b8f071d7ca85637086f1a38873d86937aa1b180de301ff3ef7211dcefc0922

  • SHA512

    d9c2ecd4a131466cb49e77016b062e802848cdc70343d7b56a320d5c62222d816540469a58fb4110e807a1762aa4a3f902b4c97c78d1d5bd4d154273ecd6766c

  • SSDEEP

    1536:QM6jnaxvwQ5zttkv7EoIzUY9OXkHAoFWVL5zzgeWk8x7o1/ilEXeUKfZ0s3mYzz3:EgwWzoIoIUXkH61Mdkg7ogGYAuz3

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies WinLogon 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe"
    1⤵
    • Identifies Wine through registry keys
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Users\Admin\AppData\Roaming\zzbrenkzz.exe
        "C:\Users\Admin\AppData\Roaming\zzbrenkzz.exe"
        3⤵
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Maps connected drives based on registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2448
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 128
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2736

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\zzbrenkzz.exe

          Filesize

          104KB

          MD5

          437298c4fbec9e4ef812f7324ffaf4b6

          SHA1

          4468814c74f41a69d7cbc73c0e80edb02889c1f6

          SHA256

          c1b8f071d7ca85637086f1a38873d86937aa1b180de301ff3ef7211dcefc0922

          SHA512

          d9c2ecd4a131466cb49e77016b062e802848cdc70343d7b56a320d5c62222d816540469a58fb4110e807a1762aa4a3f902b4c97c78d1d5bd4d154273ecd6766c

        • memory/1528-0-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/1528-10-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/1528-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/1528-6-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/1528-4-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/1528-2-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/1528-13-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/1528-12-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB