20fa273a35371fa075dcc73ecc603d76b4f490464ba71feec2c7edb4ae738adf

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93d54efb768dc9a1944dd559334b58ef_JaffaCakes118.exe
Size

118KB
MD5

93d54efb768dc9a1944dd559334b58ef
SHA1

2a0725418e513b4d3a8ce5ccbd5475e4a218ddba
SHA256

20fa273a35371fa075dcc73ecc603d76b4f490464ba71feec2c7edb4ae738adf
SHA512

7bcb2e6c8c904824d7134b386d1cd31719c5d7a7e2448732e0f3fd1d7e8461fda7579a569a1c860f26295ea20222918adce5020728cdbac203720f5dc8d56a14
SSDEEP

1536:iHgtlVWd3jnQzH4F17hNit0I+uRgsjtPHHO:iHg3cVrQzH67h76dH

Score

1^/10

Malware Config

Signatures

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2484	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	NETSTAT.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2956	2460	93d54efb768dc9a1944dd559334b58ef_JaffaCakes118.exe	29
PID 2460 wrote to memory of 2956	2460	93d54efb768dc9a1944dd559334b58ef_JaffaCakes118.exe	29
PID 2460 wrote to memory of 2956	2460	93d54efb768dc9a1944dd559334b58ef_JaffaCakes118.exe	29
PID 2460 wrote to memory of 2956	2460	93d54efb768dc9a1944dd559334b58ef_JaffaCakes118.exe	29
PID 2956 wrote to memory of 2484	2956	cmd.exe	30
PID 2956 wrote to memory of 2484	2956	cmd.exe	30
PID 2956 wrote to memory of 2484	2956	cmd.exe	30
PID 2956 wrote to memory of 2484	2956	cmd.exe	30
PID 2956 wrote to memory of 2540	2956	cmd.exe	33
PID 2956 wrote to memory of 2540	2956	cmd.exe	33
PID 2956 wrote to memory of 2540	2956	cmd.exe	33
PID 2956 wrote to memory of 2540	2956	cmd.exe	33
PID 2956 wrote to memory of 2488	2956	cmd.exe	34
PID 2956 wrote to memory of 2488	2956	cmd.exe	34
PID 2956 wrote to memory of 2488	2956	cmd.exe	34
PID 2956 wrote to memory of 2488	2956	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\93d54efb768dc9a1944dd559334b58ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\93d54efb768dc9a1944dd559334b58ef_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\90AB.tmp\zbpc check.cmd""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -b
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- - C:\Windows\SysWOW64\findstr.exe
    findstr ":8080 :8000" C:\Users\Admin\AppData\Local\Temp\zbcheck.txt
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\findstr.exe
    findstr ":8080 :8000" C:\Users\Admin\AppData\Local\Temp\zbcheck.txt
    3⤵
    PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\90AB.tmp\zbpc check.cmd

Filesize
924B

MD5
d32604c9b7ad62116477c693d392d167

SHA1
71c5afd24a84c6cf0c6ac3e6c0687a0bdff0185e

SHA256
b15f8ab3f8af55a88d747e1bfa46265042063d97b78baba9700f91675ca36c5e

SHA512
6fe385e74677503a79f1984feaaf3c8289fe9f3cbe6b244454fde8e55345feec97ae941ad93ce2d5f4d39632ac4d355b16d5cb4d71e4139f00beda2117c1a901

Download Submit
C:\Users\Admin\AppData\Local\Temp\zbcheck.txt

Filesize
585B

MD5
883bd6ae86a69e202413996a99c93623

SHA1
c3c6660cd9577d35ac36841c537842c23af30b2e

SHA256
35403cf4d6fc5046ed2039108e70fc52816f10e31384541128d8a1383ad4ed00

SHA512
3d251ab1e28c4a1872c1b75d4c750e61940dd305072505759e87dcfb3cbf111535f59491c2ca25b74a3407e06559ae1122ffe73c22cd1eab7779dd23188ca8fd

Download Submit