d10cf16947ad60ea7a7bdc9b29031747e2da48d03d43c32e45be9b8896a61a17

Analysis

max time kernel
126s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2aa5740e2a2b0f1b0fb9bdcabcf5da2d_JaffaCakes118.exe
Size

192KB
MD5

2aa5740e2a2b0f1b0fb9bdcabcf5da2d
SHA1

d62140dcf650d05344e054c79fc13d88a9954846
SHA256

d10cf16947ad60ea7a7bdc9b29031747e2da48d03d43c32e45be9b8896a61a17
SHA512

a7a5607d42930e82446a688cb6e7d29f8fe9cd9aa796312a1fcf350c39be6204ebdb5473c4c3172a2d688a3937f20a514cff6ad3142204d617545d30b502857e
SSDEEP

1536:EvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcj0Srowqjj:EvVQLIkLWeaA8KlCph9hrowqjj

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.byethost12.com
Port:
21
Username:
b12_8082975
Password:
951753zx

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2504	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2256	2aa5740e2a2b0f1b0fb9bdcabcf5da2d_JaffaCakes118.exe
2256	2aa5740e2a2b0f1b0fb9bdcabcf5da2d_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\bebb76eb\jusched.exe	2aa5740e2a2b0f1b0fb9bdcabcf5da2d_JaffaCakes118.exe
File created	C:\Program Files (x86)\bebb76eb\bebb76eb	2aa5740e2a2b0f1b0fb9bdcabcf5da2d_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	2aa5740e2a2b0f1b0fb9bdcabcf5da2d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2504	2256	2aa5740e2a2b0f1b0fb9bdcabcf5da2d_JaffaCakes118.exe	28
PID 2256 wrote to memory of 2504	2256	2aa5740e2a2b0f1b0fb9bdcabcf5da2d_JaffaCakes118.exe	28
PID 2256 wrote to memory of 2504	2256	2aa5740e2a2b0f1b0fb9bdcabcf5da2d_JaffaCakes118.exe	28
PID 2256 wrote to memory of 2504	2256	2aa5740e2a2b0f1b0fb9bdcabcf5da2d_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2aa5740e2a2b0f1b0fb9bdcabcf5da2d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2aa5740e2a2b0f1b0fb9bdcabcf5da2d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\bebb76eb\jusched.exe
  "C:\Program Files (x86)\bebb76eb\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\bebb76eb\bebb76eb

Filesize
17B

MD5
7bdf61d37c9adf3e1c6937107016091f

SHA1
56b8e0c454f9dd16d508a04b3afa7e458453ac41

SHA256
4c57d86c256214baa0a5a3322ef5cdd575210455b7e964ad60382bd9d4be12e0

SHA512
ff4fc1a427c84f47042375749f45ee6edea73b902ae977f14243ebceb7b9a28f41fe5dd404e3ea381754d9122202bc6b61ed0152b20a1c1be76c225dd20861d1

Download Submit
\Program Files (x86)\bebb76eb\jusched.exe

Filesize
192KB

MD5
8a53fd780ac37475084778c968e4d1d0

SHA1
ab4e601cdc28aaea426383a2eb74d9990203163d

SHA256
2d1e8a5bf2b35077a9bb7614ef67a2e82c60195a56a15b8dbcd08c3c6de687ec

SHA512
c80853d5c9ea01e9a09f07a7d314f5e6d082d8650cb19a318278dee42b34b3442da5e8b9c42644ac5202ef998244315969b7c3e146f7afa11b6797627eb731bc

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads