e1497fdc141ec6db3bf03a6df176c51b11443895dbe8f02abd7a874454dfa621

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe
Size

116KB
MD5

fcd97c39ece3d921ef167515efb5ba15
SHA1

4a8d7e10b9018c92d9bb338152df8a4333936839
SHA256

e1497fdc141ec6db3bf03a6df176c51b11443895dbe8f02abd7a874454dfa621
SHA512

85ac0701ae3389413f8957b89e772b3d11375f9ef73e072dfb0b01dfde52d425b4cc15d11726ab6468dec57ba8878bc216720e87b978ad82c9f500dff8d77379
SSDEEP

1536:e8MFN7qNlfNe+zLipk+JOmuvBGVa/TYareDRRdauTZ8yEnm+Ad4gricMsR:Cb7q71LzLikOupGVgeDsuTZAo4lsR

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1124	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1124	836	fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe	28
PID 836 wrote to memory of 1124	836	fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe	28
PID 836 wrote to memory of 1124	836	fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe	28
PID 836 wrote to memory of 1124	836	fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Swf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Swf..bat

Filesize
238B

MD5
135734325998f8ccad9e39473c0420cf

SHA1
40d63174c6da265f540f9eabbbb9b23b29587d2d

SHA256
7cb8fea3b052e201bfc24deb1086e6c69268d2d814643f678c49158ce50b861f

SHA512
4da6c3a2923dcb271d53cb6a69e13ea6e1a44882e994c0475319ae93ee8e031da8aa3314177bef8fac05f2179f68d10d3012731db58defc9980fe71f52a883f0

Download Submit
memory/836-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/836-1-0x0000000000190000-0x000000000019C000-memory.dmp

Filesize
48KB

Download
memory/836-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/836-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download