Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-06-2024 17:21
Behavioral task
behavioral1
Sample
03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe
-
Size
156KB
-
MD5
03210cf681bc7de73a54a5062fe7bc87
-
SHA1
14aebef1f9d5d44ea4d0e0a740ddb19e8870522d
-
SHA256
54dc254338e6a99e689c8d64063c55439c2aba4d135eeec55dc345afc2338ca1
-
SHA512
6b9a59a93783a32ec039dabaefa94bd1d671b4d42a1f14bc066330f3aea5ea86ac7c38358fc6d7beff71ad5ca17d496a6b582bf60fbed610fced56a1ec0248b8
-
SSDEEP
1536:yXZ56F5r5JZJWEtVpFqN9BBKweuVHZJ71/j+suPG0Hc18yPsWjcdWny6k04yW/Xe:yp56zRJ83+OJ7NoGvdwWy6k04yW/KNb
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2624 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 2896 biudfw.exe -
Loads dropped DLL 1 IoCs
Processes:
03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exepid process 3068 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exedescription pid process target process PID 3068 wrote to memory of 2896 3068 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe biudfw.exe PID 3068 wrote to memory of 2896 3068 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe biudfw.exe PID 3068 wrote to memory of 2896 3068 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe biudfw.exe PID 3068 wrote to memory of 2896 3068 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe biudfw.exe PID 3068 wrote to memory of 2624 3068 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe cmd.exe PID 3068 wrote to memory of 2624 3068 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe cmd.exe PID 3068 wrote to memory of 2624 3068 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe cmd.exe PID 3068 wrote to memory of 2624 3068 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
PID:2896 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
PID:2624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\golfinfo.iniFilesize
512B
MD5ac5e84ed8031d66a9fcd5e472ba8091b
SHA106303add604104d6abbb69458f89773c066b470c
SHA2563a3cfa6f4786dab0ac8bc76204948f32a3a2cbd094922f87c251ec80d22baae5
SHA5127bf829102a70a1304dae435b8ae3c9ef9a925af7e995fe381d80730f4f702e1fd2a0a1b6a3a4b4667925f5bb95c897166a8fc0f52d3171d9cdba0bf09b53f152
-
C:\Users\Admin\AppData\Local\Temp\sanfdr.batFilesize
302B
MD5ad3ecdda1cac91103547223816b0508b
SHA1707980d1c1c2948184d96ce4b66daa9f86257f20
SHA256eaa4c6fdd5e8d0707e56835821607d08c77bf47c2e13eebefef9a02892b968c9
SHA512efca21b463252375e4e7da99b7a927d76606c4b08308fd2b30bd0092d686092d7a55536d8c162cb632eca90162391e13c6fd60623c49f4e4bb98157d7a7568f2
-
\Users\Admin\AppData\Local\Temp\biudfw.exeFilesize
156KB
MD5735fe1f1ab010ccdc3b8b51e0f081c86
SHA113ec019ba64411067df3be68b878fe0c68162b88
SHA2562024eb2f134f68696b15ef208376eb163b9cc729032f433955985b163b5ccddb
SHA512dfd6eb96cb9eeb6497a96c3d304a48fc075e7c9acaeaf73562016e430afd0d7aa3d737b8e3bca02be33e53e5b5020e0c3b54e1bf5e6ca3575210b0bcc8c86f86
-
memory/2896-10-0x0000000000170000-0x000000000019B000-memory.dmpFilesize
172KB
-
memory/2896-21-0x0000000000170000-0x000000000019B000-memory.dmpFilesize
172KB
-
memory/3068-0-0x00000000010B0000-0x00000000010DB000-memory.dmpFilesize
172KB
-
memory/3068-9-0x0000000000800000-0x000000000082B000-memory.dmpFilesize
172KB
-
memory/3068-18-0x00000000010B0000-0x00000000010DB000-memory.dmpFilesize
172KB