b278c83cb2bd5b1dccd6d5fab6d3bbc29fc5ba4149450935ee9a4d618d0f5066

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe
Size

301KB
MD5

05268db45422d0d7372eda3ee89fe504
SHA1

ab2ecc6323b5e492670993d5587f4c9176b7f1ee
SHA256

b278c83cb2bd5b1dccd6d5fab6d3bbc29fc5ba4149450935ee9a4d618d0f5066
SHA512

2be37a209b95ec679216ab2d617bce730d7c33e52026dfadc105966fb7a51e3ef33c24e34c0ba7e6b946aa4b786f822aab29992efde35da13955a7e0fc9abbe0
SSDEEP

6144:alByr8TQmfqSUKzjLgG124I6PzZXxq3HSU2wbqfq/ZToQN:aLygPYK/LF12bm903xMfCZUQN

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
296	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2304	Bitoot

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Bitoot	05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Bitoot	05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Delete.bat	05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	Bitoot
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	Bitoot
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	Bitoot
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	Bitoot
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	Bitoot
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	Bitoot
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	Bitoot
Key created	\REGISTRY\USER\.DEFAULT\System	Bitoot
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	Bitoot

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2304	Bitoot

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 296	2928	05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe	29
PID 2928 wrote to memory of 296	2928	05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe	29
PID 2928 wrote to memory of 296	2928	05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe	29
PID 2928 wrote to memory of 296	2928	05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Delete.bat
  2⤵
  - Deletes itself
  PID:296

C:\Program Files (x86)\Common Files\Bitoot
"C:\Program Files (x86)\Common Files\Bitoot"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Bitoot

Filesize
301KB

MD5
05268db45422d0d7372eda3ee89fe504

SHA1
ab2ecc6323b5e492670993d5587f4c9176b7f1ee

SHA256
b278c83cb2bd5b1dccd6d5fab6d3bbc29fc5ba4149450935ee9a4d618d0f5066

SHA512
2be37a209b95ec679216ab2d617bce730d7c33e52026dfadc105966fb7a51e3ef33c24e34c0ba7e6b946aa4b786f822aab29992efde35da13955a7e0fc9abbe0

Download Submit
C:\Windows\Delete.bat

Filesize
214B

MD5
96fd497cc751bca47811bae514b979ed

SHA1
cefcba369e4fc6d3ee90768eed068952f05c2258

SHA256
18a941cd54f3724e185fa0f1fde2565e0ce25f7b03f0cd3d5874bcf92d5f303a

SHA512
9262f50745c04fd464819027eb131198b790108daa12956aa43f893fd59fe00565eea33cc217a7051aebb5cc5c916660b6c4dcc39c1a4f9518552150478c0ccb

Download Submit
memory/2304-5-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2304-6-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2304-17-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2304-19-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2304-21-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2304-25-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2304-29-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2928-0-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2928-1-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2928-14-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download