71df0f59d2634568b6753b0a69d9c3fa70b085e59f11c5c7dda04a8b4b37c4f7

Analysis

max time kernel
128s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5601c69020b1f8f0ca8db5d7c7cddd9d_JaffaCakes118.exe
Size

326KB
MD5

5601c69020b1f8f0ca8db5d7c7cddd9d
SHA1

023d3111ba8f9fdcfd2de600ffa401a7c042bd2f
SHA256

71df0f59d2634568b6753b0a69d9c3fa70b085e59f11c5c7dda04a8b4b37c4f7
SHA512

ec6a123d0faccc1819fb91456b730ae2cf9a0755ce1b9df4732537b588af985fd6d4e40fa01a3a3904fa86a5b93cbdea56c8dbccf5ed300c26c4fb8ec2ea80eb
SSDEEP

6144:x9Y1hfuOJr4ZVkdL4LA2ZhYDPNWWkGy0keNbAgvp:/YnuZi540IhDaNVvp

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe
2368	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe

Loads dropped DLL 2 IoCs

pid	Process
1924	5601c69020b1f8f0ca8db5d7c7cddd9d_JaffaCakes118.exe
1924	5601c69020b1f8f0ca8db5d7c7cddd9d_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	5601c69020b1f8f0ca8db5d7c7cddd9d_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2580	1924	5601c69020b1f8f0ca8db5d7c7cddd9d_JaffaCakes118.exe	28
PID 1924 wrote to memory of 2580	1924	5601c69020b1f8f0ca8db5d7c7cddd9d_JaffaCakes118.exe	28
PID 1924 wrote to memory of 2580	1924	5601c69020b1f8f0ca8db5d7c7cddd9d_JaffaCakes118.exe	28
PID 1924 wrote to memory of 2580	1924	5601c69020b1f8f0ca8db5d7c7cddd9d_JaffaCakes118.exe	28
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31
PID 2580 wrote to memory of 2120	2580	4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5601c69020b1f8f0ca8db5d7c7cddd9d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5601c69020b1f8f0ca8db5d7c7cddd9d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Roaming\winapp\4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe
  C:\Users\Admin\AppData\Roaming\winapp\4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\system32\svchost.exe
    svchost.exe -k netsvcs
    3⤵
    PID:2120

C:\Windows\system32\taskeng.exe
taskeng.exe {33CB34A5-AB2D-47CC-A263-83B6B4811EB4} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2380
- C:\Users\Admin\AppData\Roaming\winapp\4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe
  C:\Users\Admin\AppData\Roaming\winapp\4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\winapp\4500b58010a0e7e0ba7ca4c6b6bccc8c_IaeeaBajdr007.exe

Filesize
326KB

MD5
5601c69020b1f8f0ca8db5d7c7cddd9d

SHA1
023d3111ba8f9fdcfd2de600ffa401a7c042bd2f

SHA256
71df0f59d2634568b6753b0a69d9c3fa70b085e59f11c5c7dda04a8b4b37c4f7

SHA512
ec6a123d0faccc1819fb91456b730ae2cf9a0755ce1b9df4732537b588af985fd6d4e40fa01a3a3904fa86a5b93cbdea56c8dbccf5ed300c26c4fb8ec2ea80eb

Download Submit
memory/1924-4-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1924-2-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1924-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1924-3-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/1924-14-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1924-1-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2120-32-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2120-24-0x0000000140000000-0x0000000140025000-memory.dmp

Filesize
148KB

Download
memory/2368-35-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2580-15-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2580-16-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/2580-19-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2580-31-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download