Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    30/04/2024, 09:33

General

  • Target

    0984bf3ea17556ec9cac91071a617415_JaffaCakes118.exe

  • Size

    260KB

  • MD5

    0984bf3ea17556ec9cac91071a617415

  • SHA1

    d101abb87efe689068f2fff0d71e766cb1941e07

  • SHA256

    6d64452734a1bb641a51f24c68b2276740a299e27c0167c863fe96ec75ddab35

  • SHA512

    92baee9ae9258e0a658b387e14586ee196a552154beb1ea58b682e60ba40381894bce354947711ed9c610bcfc6eb9223e01929eb8593f4f3a955fdcc593bb737

  • SSDEEP

    3072:cBlvaWjzrLXQQJKgmSBAVpet2ngoel4WWI+OXKWI438:8paWjz/gGKgmS+k2i1W/+7e

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0984bf3ea17556ec9cac91071a617415_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0984bf3ea17556ec9cac91071a617415_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Program Files (x86)\c0efe9da\jusched.exe
      "C:\Program Files (x86)\c0efe9da\jusched.exe"
      2⤵
      • Executes dropped EXE
      PID:2812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\c0efe9da\c0efe9da

    Filesize

    17B

    MD5

    2130fee70fc3f7c10d5279f96f98ad1e

    SHA1

    4307cef89171fa230048ea22546802198d888780

    SHA256

    3506e286f6223ccaf1665d4e457b712abeb527266ff28327ce60e37b9fbeb404

    SHA512

    67fa1bb31028ff3ba125f184207499b9205f58c9eef2ac948f5824475515c396b3d5f93e207cb96deffe1aedb286b1f935cc689c5d84449e51c517da1cffe2e5

  • \Program Files (x86)\c0efe9da\jusched.exe

    Filesize

    260KB

    MD5

    995b1f13ddf88e6cc98d0dfa7022c9fc

    SHA1

    a9f693b4eb271f0c29a59ecc22915f0791d1e502

    SHA256

    e8408ca0a28be6ed02b1dd82a211f4dd172f7d1029f603f6f7c2a2e002d29259

    SHA512

    f10807d35ad69b62013b5820ef54950fd53ceb1360749a72df8a8c65c6442b4d885b6c36065cec0fef8c44ab241214804265ed7f7beb959157bf9fdd17ce8ff6

  • memory/1180-0-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/1180-6-0x0000000001F90000-0x0000000001FE8000-memory.dmp

    Filesize

    352KB

  • memory/1180-13-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2812-14-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB