58699ab5d4d95d6755f4582bf6f7bbd8e1ef2b91f64e9845b2646e1350649f0d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
Size 789KB
Sample240526-mpdbpsfc6z
SHA256 58699ab5d4d95d6755f4582bf6f7bbd8e1ef2b91f64e9845b2646e1350649f0d
MD5 7535365c3a3597101d7bcd9e2bacd1d7
SHA1 c4d4e596d414ab22767cd1b21fa901f735083878
SHA512 f812e0aff7bd56ba44778076390eae4c24d3cc89eb754c7160e64e8a9619541fff17d5167df3850933af8f3873512c6b15ca395fad2246b244e6c3c0a6b9ac09
SSDEEP 12288:StobbXN42nHq+EgqfRAUEcB3gOE6DZlZUXavlXluE70pFdZigcyrG4EEu44S+j:St8RHjEgYAw1hZlZTWQu7igcyKPEujz
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3020	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
1600	7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
1600	7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2004	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3020	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3020	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
3020	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
3020	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 3020	1600	7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	28
PID 1600 wrote to memory of 3020	1600	7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	28
PID 1600 wrote to memory of 3020	1600	7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	28
PID 1600 wrote to memory of 3020	1600	7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	28
PID 1600 wrote to memory of 3020	1600	7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	28
PID 1600 wrote to memory of 3020	1600	7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	28
PID 1600 wrote to memory of 3020	1600	7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	28
PID 3020 wrote to memory of 2936	3020	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	31
PID 3020 wrote to memory of 2936	3020	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	31
PID 3020 wrote to memory of 2936	3020	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	31
PID 3020 wrote to memory of 2936	3020	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2004	2936	cmd.exe	33
PID 2936 wrote to memory of 2004	2936	cmd.exe	33
PID 2936 wrote to memory of 2004	2936	cmd.exe	33
PID 2936 wrote to memory of 2004	2936	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\nsy7C0.tmp\internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\nsy7C0.tmp\internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe /baseInstaller='C:/Users/Admin/AppData/Local/Temp/7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe' /fallbackfolder='C:/Users/Admin/AppData/Local/Temp/nsy7C0.tmp/fallbackfiles/'
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\19952.bat" "C:\Users\Admin\AppData\Local\Temp\9105D29FD13A4A6687E0157B23BBD966\""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 1000
      4⤵
      Runs ping.exe
      PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$IGOII1C

Path C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\$IGOII1C
Size 544B
SHA256 fe909609b451be77398536165bba73c79e1df966f35583667911e7c8e1aec07c
MD5 18c6c9919d48316991e160e4981b8b46
SHA1 2c99368f8453008d1156502b5dc15475bf4cedd0
SHA512 f5a6f8ee4aa0cd51aa0b7e944cc43fc12433fdc3ef8143db13c09e24fea973b3e4f692a178217b08058a0a772ad9fddeb0118325a824a9918a701822b474b208
MD5 SHA1 SHA512

Submit Download

$IK847IG

Path C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\$IK847IG
Size 544B
SHA256 bf5888310b8d897f2e8fa89ca9233d318b252696b91cd0336b64e6546ac27bd7
MD5 41a6e52aa3ee9920a063494af2b17412
SHA1 a512c853a5381c6f0cef9f768352d2f490baab58
SHA512 1503a5c4081bdaee5206e4659d521804b8873f4488f9033d1e388aa58a215dfbfd00d567fb553bd318a0e246abe5478d8ffe8ee612ad60aa0251c06d3084a227
MD5 SHA1 SHA512

Submit Download

19952.bat

Path C:\Users\Admin\AppData\Local\Temp\19952.bat
Size 212B
SHA256 cdb93994093a24991c246d8b6f7003920a510a45bfc8441521314ce22a79191d
MD5 668767f1e0c7ff2b3960447e259e9f00
SHA1 32d8abf834cce72f5e845175a0af2513b00504d8
SHA512 c07f26c8601cf91d9805004668463721ab91e14f3cc59e77e20f43d98e070ea8e742c38fe8021c4ffb1ebc02e3743ab732b66ff84bb24b59a5fdcc8634c77680
MD5 SHA1 SHA512

Submit Download

9105D29FD13A4A6687E0157B23BBD966_LogFile.txt

Path C:\Users\Admin\AppData\Local\Temp\9105D29FD13A4A6687E0157B23BBD966\9105D29FD13A4A6687E0157B23BBD966_LogFile.txt
Size 9KB
SHA256 ad6de62c000f476c4549e42add30509071a788661722424b64088ef873867749
MD5 f12f13ee3e737c6f29c61db0bd9f6a13
SHA1 a43eaaddb79df0a5a7ab645fdfb9bbfbb44eb085
SHA512 c8f769a6ceb502359ab1e0e27f11cf8a14c3cb91ec4e2a9709ecc933e9960b630d1e23c5856e9b0cac2293b919eb8e4184ac55a77eb06a501cfcaec8c35bc918
SSDEEP 192:K/Thtu9/b/j/b/vR/u/L1/6/e/1aD/Nw/Nhtu9/P/D/I/b/s:K/Tu/b/j/b/5/u/Z/6/e/1M/Nw/N2/PN
MD5 SHA1 SHA512 SSDEEP

Submit Download

9105D2~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\9105D29FD13A4A6687E0157B23BBD966\9105D2~1.TXT
Size 110KB
SHA256 6674de49c3f1e00c8b9df4606c0fa8f55122e709cb022f44b29dc12949d3b959
MD5 02feacba4df71aebbcd63aa1938c0cdc
SHA1 42bebf4814e363ceab9ffc4eb938da8cab64babc
SHA512 2b87212640e88b3732c4abf4555cecefa7830141a5384aa31eb5d858ffcb32b422a0c42be155378a923f6cf6b78fd054816eec3f13749dd0ea228f38463f1e66
SSDEEP 768:K/y/b/j/b/5/u/Z/6/e/1M/Nw/M/P/D/I/b/9/uj+/s/u/t/RB/R2/J/v/p/s/UA:9L0y+F
MD5 SHA1 SHA512 SSDEEP

Submit Download

internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118_icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nsy7C0.tmp\internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118_icon.ico
Size 17KB
SHA256 78d0ed2288334f341225acee3d6200d01bb0bb80b873c448ab151d0661817bf2
MD5 055c2cb77fa2edc2802b7fd397b9c213
SHA1 e6bf5af3427539bf609cfb8904b35803a06104d3
SHA512 7dc2930b9ac4843cca0a073a9195ab0cfb684b29c13622d0f934fb4b4a45af0fbb3a033f6ba31216214a9cbc1966436c36dd065c44b014c5c2a03dfd0b005a65
SSDEEP 96:XDvM6oG5UdUcuqdXnn/mycLMLnzI5aH+es/HlayQ4c6g5FHGCpthcepdozEgzWmn:XrZ5ISe/my9I0H+eCHbQ4c6geeDozn6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118_splash.png

Path C:\Users\Admin\AppData\Local\Temp\nsy7C0.tmp\internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118_splash.png
Size 12KB
SHA256 1cb036da61dc7b1ad62280681c724d74cbcc313d530a799728a4d38b4e2b1983
MD5 fe272d040e82704707b19bfbf29d65ca
SHA1 460de628ea63986a7e6390a1623d8ba32dc82aee
SHA512 8a03f9f3ce7af53b2f119f9bd001ff3fd39f879de88723306e2a6c7e8cae679d2095be6d4520ea24035c86140ef01a178a0b2535674be5c39b8b2dde4d082b1b
SSDEEP 384:uLGOts/16mbzoclsCGmutWLP5baar1nflf:uLjLQzochu8RbPrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

StdUtils.dll

Path \Users\Admin\AppData\Local\Temp\nsy7C0.tmp\StdUtils.dll
Size 14KB
SHA256 0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16
MD5 21010df9bc37daffcc0b5ae190381d85
SHA1 a8ba022aafc1233894db29e40e569dfc8b280eb9
SHA512 95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e
SSDEEP 192:OFb8Y8oqy2mqZc9hGBQHRx39oRxmMvURkB/Fs:qb8Y8nKqohGBKxox9vURw/a
MD5 SHA1 SHA512 SSDEEP

Submit Download

internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe

Path \Users\Admin\AppData\Local\Temp\nsy7C0.tmp\internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
Size 1.8MB
SHA256 f2126481c02d2a5af29e56023902a0897d05867c1caaf8079cf6e1f05dd9b209
MD5 9ab5db4bb5971035b4d287d64f9676b5
SHA1 33d17f016339572dd05c124d6243fffefd0cd039
SHA512 d36262fdd4d8bd083d8537f0698c423240c9e42b2dc0048e2470d87411f295d6e3428587b76b0486875495d502f1f31f9edf3eb6fdb914f13421b7f29fa5f066
SSDEEP 49152:G0BIrT/YNRoLlps7tZokvTopSdmX4Foni7iMmdc:GbTRps7Xj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1600-125-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1600-302-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3020-79-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/3020-216-0x0000000000250000-0x0000000000251000-memory.dmp

Download