0a40d5bc35bc6097183a6caf5b94785fcfe13ce006494378cc6f5bd700f601cd

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe
Size

123KB
MD5

2b7d451e6f39914b568a4f2eb5aa3fa3
SHA1

c30b8027d75e45356278f1445c09762331f72fda
SHA256

0a40d5bc35bc6097183a6caf5b94785fcfe13ce006494378cc6f5bd700f601cd
SHA512

a931a2e85eef92f0b7b0fcb57a8d6e4578cad0e2dd3695c46b3400ff6988eb7236ef04bd07b1affcc35742708af6ed378dadb71538e0fcdb6beb4cbcdede5fbc
SSDEEP

1536:KUA8SRNj73r3g6odqJhXVMlN9NRqdfngYCMeURsoqejzwFUr2/jgVMvM+gaOdg0w:SaKcqhSq0+rmsVz+nOufIndtLzy5qT+

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1056	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1056	2292	2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe	28
PID 2292 wrote to memory of 1056	2292	2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe	28
PID 2292 wrote to memory of 1056	2292	2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe	28
PID 2292 wrote to memory of 1056	2292	2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Mgf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mgf..bat

Filesize
238B

MD5
c36143928aea7c040c9c200aeb12e2cc

SHA1
6de5b73f752fc80edfe70d0da52f99dbd565e789

SHA256
dc077e3d21e7f482841d67ef120d3902529f7b65fdc2e4ba2a10597cfb6e0642

SHA512
055c13e1d692bc6623f76f688709efbe2485a856e95b3e1ef11b3d0b48cbf57451b99c2bd795e5eaef2fdd9eb4f28b2e1749291be867e7380d6a80aff1ba2091

Download Submit
memory/2292-0-0x0000000000409000-0x000000000040B000-memory.dmp

Filesize
8KB

Download
memory/2292-2-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2292-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2292-4-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2292-3-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2292-6-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download