Analysis

  • max time kernel
    147s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2025, 20:51

General

  • Target

    JaffaCakes118_4392a267463ca34065f7d7a946ce6361.exe

  • Size

    240KB

  • MD5

    4392a267463ca34065f7d7a946ce6361

  • SHA1

    f0f35c157dba389858ec3fe3bf71769dc22f81c9

  • SHA256

    d3a7b7b8400ecf781dcfccd1160783d198cc906e4b96906b9624d950b506b1fc

  • SHA512

    863300a9cb3c05d0903fe461fed248168450b9c1c363d42a3d806bac42c776287d9f17d3dc5692dcfefdf476d7a66f2c4bc365ab59df190dec6d844f533e69a9

  • SSDEEP

    3072:G+b8oarx9+/HQLvYKTFmpTZWuetGsGMzMv69D4WrzOSsvZzkuDj3mw2j7VqaSp66:G+crEHOYYmlIGbi9VrERLvYNqclm7

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4392a267463ca34065f7d7a946ce6361.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4392a267463ca34065f7d7a946ce6361.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2404
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\Uer.bat
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2812
  • C:\Windows\Utility Mang.exe
    "C:\Windows\Utility Mang.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
        PID:2664

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\Uer.bat

            Filesize

            214B

            MD5

            b1cbe41d15542f7b30c4cd501f6d3f2c

            SHA1

            bc9932c60d777fb68795433444f716494fc3e3dd

            SHA256

            44abe5a681992bbc1a09c2a674df09cbed77e0493fef5db06d83731ba34f7341

            SHA512

            08eab59b01b6bcb4417dfe77b4d54c617e9d7d6c12d27def70dc41659c6f20f7fed3f779cfeb130bb924515c4b2418568e7e1834ba34506f52e4bdff0fa73999

          • C:\Windows\Utility Mang.exe

            Filesize

            240KB

            MD5

            4392a267463ca34065f7d7a946ce6361

            SHA1

            f0f35c157dba389858ec3fe3bf71769dc22f81c9

            SHA256

            d3a7b7b8400ecf781dcfccd1160783d198cc906e4b96906b9624d950b506b1fc

            SHA512

            863300a9cb3c05d0903fe461fed248168450b9c1c363d42a3d806bac42c776287d9f17d3dc5692dcfefdf476d7a66f2c4bc365ab59df190dec6d844f533e69a9

          • memory/2404-0-0x0000000000400000-0x00000000004E3000-memory.dmp

            Filesize

            908KB

          • memory/2404-1-0x0000000000260000-0x0000000000261000-memory.dmp

            Filesize

            4KB

          • memory/2404-2-0x0000000000260000-0x0000000000261000-memory.dmp

            Filesize

            4KB

          • memory/2404-15-0x0000000000400000-0x00000000004E3000-memory.dmp

            Filesize

            908KB

          • memory/2408-6-0x0000000000260000-0x0000000000261000-memory.dmp

            Filesize

            4KB

          • memory/2408-17-0x0000000000400000-0x00000000004E3000-memory.dmp

            Filesize

            908KB

          • memory/2408-18-0x0000000000260000-0x0000000000261000-memory.dmp

            Filesize

            4KB