Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 07:57
Static task
static1
Behavioral task
behavioral1
Sample
219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe
-
Size
59KB
-
MD5
219d5dd95e4c69f07bac60975696d3a8
-
SHA1
dc19d95cdce0ec461977545e99cb3c54d4d00778
-
SHA256
e20d34a3d3d09fa050e8c13adc532aa8e7d7b43f01822a5af915b20acb59d29d
-
SHA512
018c084573384516da9ed61ac335c899a2634c4f42ea10a414ee1068a6eee1e8febc36c5434e261335db852d250b84ec37d3a34664e95102e72671c58cd1f20c
-
SSDEEP
768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPl:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdA
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3000 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 3020 biudfw.exe -
Loads dropped DLL 1 IoCs
Processes:
219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exepid process 2848 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exedescription pid process target process PID 2848 wrote to memory of 3020 2848 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe biudfw.exe PID 2848 wrote to memory of 3020 2848 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe biudfw.exe PID 2848 wrote to memory of 3020 2848 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe biudfw.exe PID 2848 wrote to memory of 3020 2848 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe biudfw.exe PID 2848 wrote to memory of 3000 2848 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe cmd.exe PID 2848 wrote to memory of 3000 2848 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe cmd.exe PID 2848 wrote to memory of 3000 2848 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe cmd.exe PID 2848 wrote to memory of 3000 2848 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
PID:3000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\golfinfo.iniFilesize
512B
MD555e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1449221fd8d7196a54de2bd583625d8d1b64db56a
SHA256a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
SHA5124af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
-
C:\Users\Admin\AppData\Local\Temp\sanfdr.batFilesize
302B
MD5e5ec0d39ff9bb19977a720e417641d5e
SHA101a365a98069810ab2dce5acf9cf5514eec17ee4
SHA2566a30e3389d18e862fe2f98a26f528746de496350884c15099a15cbdfd6275260
SHA512b6be62d035975a800f9ddb9915120ec77668cc587ddcc15420b92882fd8a49fa629ae99b183057d781b0d41996bfb427109634089fb69cffb49e5005ff4af2a8
-
\Users\Admin\AppData\Local\Temp\biudfw.exeFilesize
59KB
MD52ffcbd1c6e43fc30a6f9db163b9758b8
SHA1e72de6b425c46310c1472748d4aebfb31a7dbeb4
SHA256f5e7911d8437b65d2e937ff3d57d2104afe80598f8926a0cd107458bca0e9023
SHA51217823b386903a5f964a1a7f9ee61367adfc79c9fb2b39ecc8983acc3a8b87642e44a339e55a9381e32146244d0df876756278db5a54925243afd3200570530aa
-
memory/2848-0-0x0000000001290000-0x00000000012C5000-memory.dmpFilesize
212KB
-
memory/2848-6-0x0000000000E30000-0x0000000000E65000-memory.dmpFilesize
212KB
-
memory/2848-18-0x0000000001290000-0x00000000012C5000-memory.dmpFilesize
212KB
-
memory/3020-16-0x0000000000040000-0x0000000000075000-memory.dmpFilesize
212KB
-
memory/3020-21-0x0000000000040000-0x0000000000075000-memory.dmpFilesize
212KB
-
memory/3020-23-0x0000000000040000-0x0000000000075000-memory.dmpFilesize
212KB
-
memory/3020-30-0x0000000000040000-0x0000000000075000-memory.dmpFilesize
212KB