Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 20:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1775c26866b07e9267d43451d128625a_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1775c26866b07e9267d43451d128625a_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
1775c26866b07e9267d43451d128625a_JaffaCakes118.exe
-
Size
267KB
-
MD5
1775c26866b07e9267d43451d128625a
-
SHA1
a8fe68622942af5cc9cc57a86b4eb5ba8d8f4581
-
SHA256
cfd5ddc4779f434e59069948a6ce2a2b8fd820f012738cbfb510a1eeecf07ca9
-
SHA512
9d2630ac35d26540983c876bb2191456796f33cc1bd4b42077ff5bfdda41a572be597e875fe814d08644b171ee4cb2c7195536b99c633d265aa0038de198c2fe
-
SSDEEP
6144:+3GEeC/U62M3znCmy0tjbNf7/ePV88igE5skr0o:QG3762SC07/eGRgA
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2464 bpudmlzp.exe 1956 uijrwubrkous.exe -
Loads dropped DLL 4 IoCs
pid Process 2488 1775c26866b07e9267d43451d128625a_JaffaCakes118.exe 2488 1775c26866b07e9267d43451d128625a_JaffaCakes118.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Shell Profile Solutions Window = "C:\\Users\\Admin\\Local Settings\\Application Data\\bncirtjcblsvofh\\bpudmlzp.exe" 1775c26866b07e9267d43451d128625a_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2464 bpudmlzp.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 1956 uijrwubrkous.exe 2464 bpudmlzp.exe 1956 uijrwubrkous.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 1956 uijrwubrkous.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 1956 uijrwubrkous.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 1956 uijrwubrkous.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 1956 uijrwubrkous.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 1956 uijrwubrkous.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 1956 uijrwubrkous.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 1956 uijrwubrkous.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 1956 uijrwubrkous.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe 2464 bpudmlzp.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2464 2488 1775c26866b07e9267d43451d128625a_JaffaCakes118.exe 28 PID 2488 wrote to memory of 2464 2488 1775c26866b07e9267d43451d128625a_JaffaCakes118.exe 28 PID 2488 wrote to memory of 2464 2488 1775c26866b07e9267d43451d128625a_JaffaCakes118.exe 28 PID 2488 wrote to memory of 2464 2488 1775c26866b07e9267d43451d128625a_JaffaCakes118.exe 28 PID 2464 wrote to memory of 1956 2464 bpudmlzp.exe 29 PID 2464 wrote to memory of 1956 2464 bpudmlzp.exe 29 PID 2464 wrote to memory of 1956 2464 bpudmlzp.exe 29 PID 2464 wrote to memory of 1956 2464 bpudmlzp.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1775c26866b07e9267d43451d128625a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1775c26866b07e9267d43451d128625a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\Local Settings\Application Data\bncirtjcblsvofh\bpudmlzp.exe"C:\Users\Admin\Local Settings\Application Data\bncirtjcblsvofh\bpudmlzp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\Local Settings\Application Data\bncirtjcblsvofh\uijrwubrkous.exeWATCHDOGPROC "C:\Users\Admin\Local Settings\Application Data\bncirtjcblsvofh\bpudmlzp.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1956
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
267KB
MD51775c26866b07e9267d43451d128625a
SHA1a8fe68622942af5cc9cc57a86b4eb5ba8d8f4581
SHA256cfd5ddc4779f434e59069948a6ce2a2b8fd820f012738cbfb510a1eeecf07ca9
SHA5129d2630ac35d26540983c876bb2191456796f33cc1bd4b42077ff5bfdda41a572be597e875fe814d08644b171ee4cb2c7195536b99c633d265aa0038de198c2fe