Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:32
Static task
static1
Behavioral task
behavioral1
Sample
581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe
-
Size
5.9MB
-
MD5
581ffbf40d0e0efd3ec50c0fb9066967
-
SHA1
b469e2670a06782ea80c79d92b523b47aa255dc3
-
SHA256
71c099ed2857f660b8431eb79cdd49300428cbf97c2cb6f98efa6e1cf30d1414
-
SHA512
96d0f4e6e5af7a411637cb7b47451d227b2f1f8e11ab72be99bc8664c7405514f8cf96042fc20e2be8ca0245a6fdee86907cd78cb853796d462ed69a46c8e3c6
-
SSDEEP
6144:TPIpEvUeazs9JSMeyUPFlsy4SEUY3V2kz5t8FF9SSl9sc5UNhK:LIpqdaNMeyUPFlR4SEU+VpdIT5U3K
Malware Config
Extracted
qakbot
325.14
tr01
1596554163
94.59.241.189:2222
86.98.66.175:2222
94.96.84.73:993
71.83.16.211:443
24.110.96.149:443
78.96.199.79:443
216.201.162.158:443
68.60.221.169:465
95.76.109.181:443
189.231.175.46:443
70.164.37.205:995
108.27.217.44:443
71.220.191.200:443
92.59.35.196:2222
71.192.44.92:443
108.30.125.94:443
93.151.180.170:61202
189.130.26.216:443
47.146.32.175:443
24.71.28.247:443
12.5.37.3:995
79.113.219.10:443
70.126.76.75:443
78.100.192.173:443
199.247.22.145:443
5.193.178.241:2078
144.202.48.107:443
90.175.88.99:2222
81.133.234.36:2222
151.73.120.201:443
166.62.180.194:2078
201.216.216.245:443
103.238.231.40:443
187.205.235.21:443
189.210.114.157:443
68.116.193.239:443
84.117.176.32:443
151.52.157.19:443
188.26.243.186:443
108.45.89.47:443
179.14.167.91:443
189.223.67.126:443
94.96.84.73:21
75.170.94.218:443
174.80.7.235:443
68.134.181.98:443
86.120.237.47:2222
51.9.198.243:2222
94.96.84.73:20
172.87.134.226:443
189.150.106.26:995
188.15.173.34:995
24.204.155.208:443
63.155.9.141:995
96.20.108.17:2222
187.192.233.135:995
115.21.224.117:443
98.4.227.199:443
5.15.54.233:443
217.165.112.13:995
207.255.161.8:993
86.126.206.141:443
188.25.192.41:443
78.97.207.104:443
189.140.64.53:443
209.182.122.217:443
173.173.72.199:443
35.134.202.234:443
134.0.196.46:995
75.136.40.155:443
70.95.118.217:443
67.6.62.74:443
186.28.178.94:443
98.173.34.212:995
173.22.120.11:2222
108.46.145.30:443
108.35.135.148:443
94.96.84.73:443
86.97.9.224:443
67.11.43.93:443
154.56.71.174:443
24.99.180.247:443
65.48.219.163:443
69.47.26.41:443
188.27.27.107:443
67.247.254.82:443
172.78.82.95:443
72.204.242.138:6881
199.247.16.80:443
80.240.26.178:443
76.187.12.181:443
5.13.102.138:995
86.153.98.2:2222
208.93.202.49:443
96.35.170.82:2078
2.51.240.61:995
67.165.206.193:993
5.15.84.129:443
67.8.103.21:443
151.205.102.42:443
96.232.203.15:443
72.240.200.181:2222
70.123.92.175:2222
73.228.1.246:443
75.111.145.5:995
24.231.54.185:2222
98.115.243.237:443
96.234.20.230:443
96.255.188.58:443
174.82.131.155:995
90.68.84.121:2222
73.227.232.166:443
71.182.142.63:443
109.92.251.113:995
24.139.132.70:443
130.25.130.19:2222
35.143.248.234:443
190.204.24.148:2078
45.32.155.12:443
173.163.115.89:2078
207.246.75.201:443
35.209.218.146:443
45.32.154.10:443
217.162.149.212:443
72.142.106.198:995
75.137.47.174:443
83.110.92.29:443
36.226.77.179:443
5.107.157.123:2222
176.205.255.97:443
213.120.109.73:2222
41.97.200.95:443
2.88.50.153:995
173.44.112.112:443
200.38.254.177:443
24.229.150.54:995
71.10.43.79:443
72.82.15.220:443
99.231.221.117:443
47.44.217.98:443
186.6.197.11:443
217.165.164.57:2222
71.88.104.107:443
68.204.164.222:443
73.104.218.229:0
173.245.152.231:443
24.203.36.180:2222
86.98.89.132:2222
24.28.183.107:995
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exepid process 2460 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe 2896 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe 2896 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.execmd.exedescription pid process target process PID 2460 wrote to memory of 2896 2460 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe PID 2460 wrote to memory of 2896 2460 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe PID 2460 wrote to memory of 2896 2460 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe PID 2460 wrote to memory of 2896 2460 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe PID 2460 wrote to memory of 2736 2460 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe cmd.exe PID 2460 wrote to memory of 2736 2460 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe cmd.exe PID 2460 wrote to memory of 2736 2460 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe cmd.exe PID 2460 wrote to memory of 2736 2460 581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe cmd.exe PID 2736 wrote to memory of 2540 2736 cmd.exe PING.EXE PID 2736 wrote to memory of 2540 2736 cmd.exe PING.EXE PID 2736 wrote to memory of 2540 2736 cmd.exe PING.EXE PID 2736 wrote to memory of 2540 2736 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\581ffbf40d0e0efd3ec50c0fb9066967_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2460-1-0x0000000000260000-0x00000000002DC000-memory.dmpFilesize
496KB
-
memory/2460-2-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/2460-0-0x0000000000400000-0x00000000009E2000-memory.dmpFilesize
5.9MB
-
memory/2460-3-0x0000000000400000-0x00000000009E2000-memory.dmpFilesize
5.9MB
-
memory/2460-6-0x0000000000400000-0x00000000009E2000-memory.dmpFilesize
5.9MB
-
memory/2460-7-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/2896-4-0x0000000000400000-0x00000000009E2000-memory.dmpFilesize
5.9MB
-
memory/2896-5-0x0000000000400000-0x00000000009E2000-memory.dmpFilesize
5.9MB