Analysis
-
max time kernel
62s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 07:44
Behavioral task
behavioral1
Sample
e469d954208648089041e21f6d882702_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
e469d954208648089041e21f6d882702_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
e469d954208648089041e21f6d882702_JaffaCakes118.exe
-
Size
2.7MB
-
MD5
e469d954208648089041e21f6d882702
-
SHA1
454bf06e9f471a7590187c7806231cb957fec5e5
-
SHA256
03dd5030cf9419d5f328b6ddf8bce820199c0aad46caf85c68aeb1645133972d
-
SHA512
54f53702056611a8be894a77651f8635bfddaa0be1705a983497b290b4b1ea8fd8513db4ddcb0831beba9fda421efb2cf67921679a5863ead16462fba478ca9a
-
SSDEEP
24576:pZKlRgOIfgOIcVylQpgst89780uEOjxWfmP/UDMS08Ckn3U:pZMW5/pVP5tI7nfmP/SA8Nk
Malware Config
Extracted
kutaki
http://sdaskmda.club/papa/love.php
http://terebinnahicc.club/sec/kool.txt
Signatures
-
Kutaki Executable 1 IoCs
resource yara_rule behavioral1/files/0x000b0000000155e2-18.dat family_kutaki -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\srxkdfch.exe e469d954208648089041e21f6d882702_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\srxkdfch.exe e469d954208648089041e21f6d882702_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2492 srxkdfch.exe -
Loads dropped DLL 2 IoCs
pid Process 2612 e469d954208648089041e21f6d882702_JaffaCakes118.exe 2612 e469d954208648089041e21f6d882702_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2612 e469d954208648089041e21f6d882702_JaffaCakes118.exe 2612 e469d954208648089041e21f6d882702_JaffaCakes118.exe 2612 e469d954208648089041e21f6d882702_JaffaCakes118.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe 2492 srxkdfch.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2584 2612 e469d954208648089041e21f6d882702_JaffaCakes118.exe 29 PID 2612 wrote to memory of 2584 2612 e469d954208648089041e21f6d882702_JaffaCakes118.exe 29 PID 2612 wrote to memory of 2584 2612 e469d954208648089041e21f6d882702_JaffaCakes118.exe 29 PID 2612 wrote to memory of 2584 2612 e469d954208648089041e21f6d882702_JaffaCakes118.exe 29 PID 2612 wrote to memory of 2492 2612 e469d954208648089041e21f6d882702_JaffaCakes118.exe 31 PID 2612 wrote to memory of 2492 2612 e469d954208648089041e21f6d882702_JaffaCakes118.exe 31 PID 2612 wrote to memory of 2492 2612 e469d954208648089041e21f6d882702_JaffaCakes118.exe 31 PID 2612 wrote to memory of 2492 2612 e469d954208648089041e21f6d882702_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\e469d954208648089041e21f6d882702_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e469d954208648089041e21f6d882702_JaffaCakes118.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp2⤵PID:2584
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\srxkdfch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\srxkdfch.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5e469d954208648089041e21f6d882702
SHA1454bf06e9f471a7590187c7806231cb957fec5e5
SHA25603dd5030cf9419d5f328b6ddf8bce820199c0aad46caf85c68aeb1645133972d
SHA51254f53702056611a8be894a77651f8635bfddaa0be1705a983497b290b4b1ea8fd8513db4ddcb0831beba9fda421efb2cf67921679a5863ead16462fba478ca9a