Analysis

  • max time kernel
    65s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2025, 20:52

General

  • Target

    JaffaCakes118_43939ed80ef8f6cc9d7f5dc15fcd48db.exe

  • Size

    201KB

  • MD5

    43939ed80ef8f6cc9d7f5dc15fcd48db

  • SHA1

    8a605b5fcacf0d7cccfdbf873ec4984cf03e925d

  • SHA256

    6ad5247f54eaec05a23e025f393291f39a6686ab38f34d5cda8fd868b627d157

  • SHA512

    b90caffb2f173f536f7c05baf10232847fafad217b10941eefa7bd6a7590feff0f47129066009ac572dd3b699a77ed7673c981d080036a6038bcd9ff2844b8ce

  • SSDEEP

    3072:TZbyo1e4F2pHeIhLposLd2r76Q/XsmWVpJG6sDciGEG+C1m76+5w0Ju3:TNBc8GoOdpQ/cRJ7UGFXMw

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 2 IoCs
  • Unexpected DNS network traffic destination 9 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:472
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Executes dropped EXE
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_43939ed80ef8f6cc9d7f5dc15fcd48db.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_43939ed80ef8f6cc9d7f5dc15fcd48db.exe"
      2⤵
      • Unexpected DNS network traffic destination
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:1048

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-18\$568593a3dddae9c8c724dfe7808f99db\@

          Filesize

          2KB

          MD5

          4e528876b4f4f13af564b3f6b697928f

          SHA1

          8535c7ce522477aebd468fc7505400dca0a11bd2

          SHA256

          41bdcc22308342206d405095566041bf7da8647f290340d3bb8663f1fa8c0731

          SHA512

          85742858b309a0fb665d6dca40ed038626b69e6352b3bccc8362ce823ec74ce9f700588091a32448afc168ba515c26304abc950d1f8244f088ab133fc2e27b6a

        • C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\$568593a3dddae9c8c724dfe7808f99db\n

          Filesize

          41KB

          MD5

          fb4e3236959152a057bc6b7603c538ef

          SHA1

          b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

          SHA256

          8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

          SHA512

          993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

        • memory/472-13-0x0000000000090000-0x0000000000091000-memory.dmp

          Filesize

          4KB

        • memory/472-22-0x0000000000090000-0x0000000000091000-memory.dmp

          Filesize

          4KB

        • memory/1244-21-0x0000000002A70000-0x0000000002A71000-memory.dmp

          Filesize

          4KB

        • memory/1244-4-0x0000000002A70000-0x0000000002A71000-memory.dmp

          Filesize

          4KB

        • memory/1244-8-0x0000000002A70000-0x0000000002A71000-memory.dmp

          Filesize

          4KB

        • memory/1956-3-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/1956-0-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

        • memory/1956-20-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/1956-19-0x000000000042D000-0x0000000000434000-memory.dmp

          Filesize

          28KB

        • memory/1956-2-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/1956-1-0x000000000042D000-0x0000000000434000-memory.dmp

          Filesize

          28KB