a02f80805f2a774396b6bf8828c2f63a054fdd286d1632fa05b967b0080ee826

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 06:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f76d926b752aa7e89953811b4db76e36_JaffaCakes118.exe
Size

79KB
MD5

f76d926b752aa7e89953811b4db76e36
SHA1

5db4ecb13e10641cb4a8a8637a8e7bfddb0397c6
SHA256

a02f80805f2a774396b6bf8828c2f63a054fdd286d1632fa05b967b0080ee826
SHA512

41fb64ff3d10ffbdd86a1d43ee8d95b7a0b4773dd04fc62fabb56dcf587519ea38e1134434fa93699dd3b86b1922edf171b336ca138fb501d9228da058b0f5b4
SSDEEP

1536:iKoYJ/VnGgXqkwk885iXMmX5zGpY8A24xk6p:1oyVGZD8IMm6J4xk

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2700	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	f76d926b752aa7e89953811b4db76e36_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2700	848	f76d926b752aa7e89953811b4db76e36_JaffaCakes118.exe	28
PID 848 wrote to memory of 2700	848	f76d926b752aa7e89953811b4db76e36_JaffaCakes118.exe	28
PID 848 wrote to memory of 2700	848	f76d926b752aa7e89953811b4db76e36_JaffaCakes118.exe	28
PID 848 wrote to memory of 2700	848	f76d926b752aa7e89953811b4db76e36_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f76d926b752aa7e89953811b4db76e36_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f76d926b752aa7e89953811b4db76e36_JaffaCakes118.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Wbz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wbz..bat

Filesize
238B

MD5
178cd338385a23fda70df122c57f0b82

SHA1
20f1cb8fb1c5be261e945f8023893798f617dd57

SHA256
fe32d2c16c37f55bcc60275272f094c70001afecc88c6f1b914b3518e137f2f5

SHA512
ff417710f29bf39432aa742c40a3798f10e537b0e1d7a9b4ecdf74b53ed2117cfb1e2c7ce33e6f2ecf89b26d9d7d27d25e663f7788741ba9f92f888c13980a32

Download Submit
memory/848-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/848-1-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/848-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/848-3-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/848-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download