14faeb5ba3e5831dd0e8f221b6021020047a1eb5fa8548d71e5fee02141a8bb4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe
Size 470KB
Sample240613-vfw2fsxbpc
SHA256 14faeb5ba3e5831dd0e8f221b6021020047a1eb5fa8548d71e5fee02141a8bb4
MD5 a69cc6b74b0feec4a1040952e0a3d824
SHA1 966b2672a8a9bd345e5abcae61685de9897524ce
SHA512 acd980fc9129ac3ad9695da0520a345aff6e92ce4b66428bedb603ec311ffa56beeb261f14699d76b2b67823e2f4c2d8a281e5f1c1673e0a2fcc197f3b349e70
SSDEEP 6144:rCMmrKJ1uRdEcZ/vkiR8hozHiFNzsPNvCVieCtqkOSnd509p1q57F4nY:rl7cZ/vFRfew9amnO4D09pi7FGY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2548	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2760	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2548	1868	a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe	31
PID 1868 wrote to memory of 2548	1868	a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe	31
PID 1868 wrote to memory of 2548	1868	a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe	31
PID 1868 wrote to memory of 2548	1868	a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe	31
PID 2548 wrote to memory of 2760	2548	cmd.exe	33
PID 2548 wrote to memory of 2760	2548	cmd.exe	33
PID 2548 wrote to memory of 2760	2548	cmd.exe	33
PID 2548 wrote to memory of 2760	2548	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1868-0-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1868-1-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1868-2-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1868-4-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1868-5-0x0000000000400000-0x0000000000462000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads