ebab1ad28ea30596404e02779915763e02f57878b526bc2eabeb4c3b5c1f8ea1

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

006684b83b9938c4566cd02bac5b4cdc_JaffaCakes118.exe
Size

196KB
MD5

006684b83b9938c4566cd02bac5b4cdc
SHA1

77d952530c2a98b3b76dea6e02ee28eb0743027a
SHA256

ebab1ad28ea30596404e02779915763e02f57878b526bc2eabeb4c3b5c1f8ea1
SHA512

76b19752fe9dd5ec5c3e83bcfb4c5f3ce2285f7275fc22ca6a7a889e35e387cb8cd337a0675ed8c9a267303e4ea25db8c03e033fd0fcc109ae90f12dba0a45b9
SSDEEP

1536:kXs9wrnUh4d7ygVpn0uv77P11gqu87hhofgzdBr:kXYw4+dGgLn0sP11gqPofgJl

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.alizametal.com.tr
Port:
21
Username:
alizametal.com.tr
Password:
hd611

Extracted

Credentials

Protocol: ftp
Host:
ftp.yesimcopy.com
Port:
21
Username:
yesimcopy1
Password:
825cyf

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1276	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2172	006684b83b9938c4566cd02bac5b4cdc_JaffaCakes118.exe
2172	006684b83b9938c4566cd02bac5b4cdc_JaffaCakes118.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\4cfe1fe7\jusched.exe	006684b83b9938c4566cd02bac5b4cdc_JaffaCakes118.exe
File created	C:\Program Files (x86)\4cfe1fe7\4cfe1fe7	006684b83b9938c4566cd02bac5b4cdc_JaffaCakes118.exe
File created	C:\Program Files (x86)\4cfe1fe7\info_a	006684b83b9938c4566cd02bac5b4cdc_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	006684b83b9938c4566cd02bac5b4cdc_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1276	2172	006684b83b9938c4566cd02bac5b4cdc_JaffaCakes118.exe	28
PID 2172 wrote to memory of 1276	2172	006684b83b9938c4566cd02bac5b4cdc_JaffaCakes118.exe	28
PID 2172 wrote to memory of 1276	2172	006684b83b9938c4566cd02bac5b4cdc_JaffaCakes118.exe	28
PID 2172 wrote to memory of 1276	2172	006684b83b9938c4566cd02bac5b4cdc_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\006684b83b9938c4566cd02bac5b4cdc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\006684b83b9938c4566cd02bac5b4cdc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\4cfe1fe7\jusched.exe
  "C:\Program Files (x86)\4cfe1fe7\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\4cfe1fe7\4cfe1fe7

Filesize
17B

MD5
6ff89798e0e63d75115c777af43a2cd9

SHA1
e8b994ccbbe64951afe91fc3dd377f88fe6c9ba8

SHA256
3b3947957c6e0abb19d91b256521bdb3826d88d9b7b53995e177a58cebf0d479

SHA512
46557f9bf6f5c5b3316891a9b623a7d11d8d8ff1973ca84cfbcf8d898746f2dbded7fee837c9a70c2e36f9b46a357fe2ba53585bf5307950d2fef6ee1dcb28a3

Download Submit
C:\Program Files (x86)\4cfe1fe7\info_a

Filesize
12B

MD5
06c388f5b572adaf9e484ae2f8b9a759

SHA1
be8d455efbd6ef25f3a52aa14e036b11ba8b98a3

SHA256
1f2563a2b5189ae31505a26fa0f7eb3235f9d1547cce61a0dcd85bded8002966

SHA512
363395dcbf88e37d5e8765d83650fd0855691a144c5a83b40291acb7c30310ae757535418b2486d2159e1b66b1de2463b2cc09c8dc4872621abfe54718e1795d

Download Submit
\Program Files (x86)\4cfe1fe7\jusched.exe

Filesize
196KB

MD5
ba7257d133985fe8a5eb551f57f6f5b4

SHA1
dd94c08587e35eed892904f63c5274bed0bc8693

SHA256
a2443277314cbfda8cecf381b730f5b76fadd4b978558ebf31df9743e5e718b8

SHA512
8e7f7d20a127309f8aa6c84e84bbc85f9e041d175a275d1ab092723b2833f6db94d8847769a4cfee37d2c044449e7d15605764969d516dc6540932be9516dcc5

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads