68057b3db60624a0eb70b73e220bb3ce6ea106a2e7b22e97a1d0dd1b5c72fdb0

Analysis

max time kernel
127s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe
Size

17KB
MD5

fa98e9fc0f35dc36b327752447df84b7
SHA1

bfdf0f38db4ca9c914a6d31d3da152984e6f55a1
SHA256

68057b3db60624a0eb70b73e220bb3ce6ea106a2e7b22e97a1d0dd1b5c72fdb0
SHA512

ccedad481d9509629c4358acddae9c7b51b47b982f721c8be872bffbfa71a192f600d69e30dc3dbb0a56f8e5b06a89ebf6302c32199ee26f10f5e6993d82bd8a
SSDEEP

384:PwlApAQ2fy9FY4mNxKMKbVVr3rcC3OiEXqJ6lXEX2TtW3k:Ils2fy9FrCKbV5cziE6MlXEO

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2356	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl\CLSID	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl\CLSID\ = "{6BF52A52-394A-11D3-B153-00C04F79FAA6}"	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2356	1948	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe	31
PID 1948 wrote to memory of 2356	1948	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe	31
PID 1948 wrote to memory of 2356	1948	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe	31
PID 1948 wrote to memory of 2356	1948	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_cls0.bat" "
  2⤵
  - Deletes itself
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_cls0.bat

Filesize
302B

MD5
ba05ea27db899608a76a0041a556e782

SHA1
0e0d172e1f270e213d49eda5f19a65c7bc6acf28

SHA256
2ff2432acc631c9528ef161e8ce24c3ded1fe46218ba4ad361ed58e01843ed18

SHA512
d3ec7799765dc0443a90ac24d2a35dd0a93f711bfce85362906a1144cf4f57bbd8c30b9355a6204d52d6e8445c84da8b90a38cdb8efdda58a2dbd98f7ec6d842

Download Submit