Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 10:57
Behavioral task
behavioral1
Sample
081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exe
-
Size
208KB
-
MD5
081bf64cfd640ad57727fa8ae209c379
-
SHA1
10a81ea6b164290c013dc8ae6ab2cee02e2f4b69
-
SHA256
326db19c5c5743a9052ef3847563fd63d66218cc73e31f78b2d89382d34310b6
-
SHA512
f78c8f2cd6cda3034f127055694ca4dad0de1d7bd9460963af1a8242c847172f2ac6bff3d9fbfcf1f43e7766020ebe9a3056dc78a0ffaf529136aa6a403034c4
-
SSDEEP
1536:1BucKHs7K2HEG7BpoWiZBYHs977q+7INVdU2Aneb61TVcz+3MJb6rcR5n:PuchogM57bIL+eb61TVa+3MJb6E
Malware Config
Extracted
urelas
112.175.88.208
112.175.88.209
112.175.88.207
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2868 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
huter.exepid process 2100 huter.exe -
Loads dropped DLL 1 IoCs
Processes:
081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exepid process 2056 081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exedescription pid process target process PID 2056 wrote to memory of 2100 2056 081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exe huter.exe PID 2056 wrote to memory of 2100 2056 081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exe huter.exe PID 2056 wrote to memory of 2100 2056 081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exe huter.exe PID 2056 wrote to memory of 2100 2056 081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exe huter.exe PID 2056 wrote to memory of 2868 2056 081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2868 2056 081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2868 2056 081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2868 2056 081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\081bf64cfd640ad57727fa8ae209c379_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"2⤵
- Executes dropped EXE
PID:2100 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
PID:2868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\golfinfo.iniFilesize
512B
MD502167b944a214fee3d34f9a7e356dc6a
SHA1ca5b3f38a7151268726401593eb35f9b67bdde97
SHA25677fcdadc9ba56daa81edb3f0ef876e38a8c7de56187c28c7d02992cd9e0a243d
SHA512c8976c66724d737105a66699673052d7bc7f1e1941c91e03f97452aaba714d35b1d55434e950b00c58626b8bcf16186a731cccc503b7ba08f080ead3eaca5817
-
C:\Users\Admin\AppData\Local\Temp\sanfdr.batFilesize
302B
MD5e4cbd3f7703bf5fe7712bf0486687a24
SHA1200a70d70edd7a9be42d63213572bb8d51a4089e
SHA25649c026cbc2d34bb4d6421b5eebab1ab687717902e9262a74c2c86a07e5785dff
SHA51285ea52431d417b631e0a7d258df8f6e2ab48c190222ffd32eac3346f0068efaf4e7d2b3e5bd3a8bd2c8bedb90cdfae372a6e219fd025564ab9e3483c3c9a1e80
-
\Users\Admin\AppData\Local\Temp\huter.exeFilesize
208KB
MD56ac178949b8d5a57e5aaade3c9aaaf80
SHA1368a23327a9d19f1a685b49572f97c7e3b63be6b
SHA2563b9868d45927e021189f562b8f6e6e42573a7763912784a9528ee396488fedf8
SHA512c6e8f73f9c476c6a5aa0fd02c679c11a44edc7c3a0842f2758d541d793107260690ce9c70dcfd94fbe700834e02606ec1e0416734a18875ba578c1f54a03a102
-
memory/2056-0-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2056-10-0x0000000002930000-0x0000000002967000-memory.dmpFilesize
220KB
-
memory/2056-18-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2100-17-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2100-21-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2100-22-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB