Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 22:59
Static task
static1
Behavioral task
behavioral1
Sample
0b1df61b227c1c54396448932003425d_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
0b1df61b227c1c54396448932003425d_JaffaCakes118.exe
-
Size
59KB
-
MD5
0b1df61b227c1c54396448932003425d
-
SHA1
c996bc5bd17b16a6f1d007416cb8f2b3e0f2b8db
-
SHA256
21090104412d20f6def9eb54902ec06250ec445fd68867bcddf512b17a74591e
-
SHA512
7622ff717bde751d6d4e2aa8a3e532837e10e8d0bdc35a8de03dcc5526eadee0688f0730690a467fd0bd8679953466d5882eab5162814f8ee634b0453c071db7
-
SSDEEP
768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPo:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdN
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2652 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 2460 biudfw.exe -
Loads dropped DLL 1 IoCs
Processes:
0b1df61b227c1c54396448932003425d_JaffaCakes118.exepid process 2164 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0b1df61b227c1c54396448932003425d_JaffaCakes118.exedescription pid process target process PID 2164 wrote to memory of 2460 2164 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe biudfw.exe PID 2164 wrote to memory of 2460 2164 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe biudfw.exe PID 2164 wrote to memory of 2460 2164 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe biudfw.exe PID 2164 wrote to memory of 2460 2164 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe biudfw.exe PID 2164 wrote to memory of 2652 2164 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe cmd.exe PID 2164 wrote to memory of 2652 2164 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe cmd.exe PID 2164 wrote to memory of 2652 2164 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe cmd.exe PID 2164 wrote to memory of 2652 2164 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b1df61b227c1c54396448932003425d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0b1df61b227c1c54396448932003425d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
PID:2460 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
PID:2652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\golfinfo.iniFilesize
512B
MD555e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1449221fd8d7196a54de2bd583625d8d1b64db56a
SHA256a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
SHA5124af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
-
C:\Users\Admin\AppData\Local\Temp\sanfdr.batFilesize
302B
MD5de71fbf9d235ee2494a7649e10a98941
SHA1c8347871190c7f57d6ccdcb153daf719bd39e8bf
SHA256cc3fcfcaf3e860fca772f2159e997a34717bd27775c33e7a37e3087bee79cff7
SHA512ec3a5e65643345f3f62ea7ae87ec4283be31850f2bc5bb0edd2875a70474bdb64bd3fb3aaff8bf9779d1ecb840346a706e6d24b50ec438c52853052b8761f736
-
\Users\Admin\AppData\Local\Temp\biudfw.exeFilesize
59KB
MD5765dd8fb1e20976e77477c66b400c311
SHA1bed66f79aff267a0431c143ba2136056627ae4de
SHA256bd162f8e53a3d25b05da8d01d647a224c0f703f216eed88f0016c4f7a6b51b1f
SHA512282d236ea6f03e2cdaa629a0514caadf0b3d3f035b563fd48676f1fdee2dc2b9fefbca17dca368d2a62793ae260a8ccf4d504e9c86dee2d69acd33f816254183
-
memory/2164-0-0x0000000000A50000-0x0000000000A85000-memory.dmpFilesize
212KB
-
memory/2164-10-0x0000000000570000-0x00000000005A5000-memory.dmpFilesize
212KB
-
memory/2164-19-0x0000000000A50000-0x0000000000A85000-memory.dmpFilesize
212KB
-
memory/2460-14-0x0000000000AD0000-0x0000000000B05000-memory.dmpFilesize
212KB
-
memory/2460-22-0x0000000000AD0000-0x0000000000B05000-memory.dmpFilesize
212KB
-
memory/2460-24-0x0000000000AD0000-0x0000000000B05000-memory.dmpFilesize
212KB
-
memory/2460-30-0x0000000000AD0000-0x0000000000B05000-memory.dmpFilesize
212KB