ef21b3e90d5b899365535d56804fc45b05a5a16305a1bac0fd0957ccf869818e

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

373d5524c1a5240b8ca7af560b6b2d75_JaffaCakes118.exe
Size

110KB
MD5

373d5524c1a5240b8ca7af560b6b2d75
SHA1

db4cebf9e60bf08a59067f9071da99c9be154835
SHA256

ef21b3e90d5b899365535d56804fc45b05a5a16305a1bac0fd0957ccf869818e
SHA512

4eb3bd0e290d1b0fa1622de11bf089942031116aa65913492e06da8543cb16263df052a28bf3cee17a57a11e42515b174e45ac1fba3af2907f8a1f655d8abaec
SSDEEP

1536:h0LFGxfLR3JaTNjDTJIBTtL9qfEovoWODtaqPhNm1ekqan2kMI:hMGh1Ja1q3L9qfHIDbJNvV

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1620	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1620	1704	373d5524c1a5240b8ca7af560b6b2d75_JaffaCakes118.exe	30
PID 1704 wrote to memory of 1620	1704	373d5524c1a5240b8ca7af560b6b2d75_JaffaCakes118.exe	30
PID 1704 wrote to memory of 1620	1704	373d5524c1a5240b8ca7af560b6b2d75_JaffaCakes118.exe	30
PID 1704 wrote to memory of 1620	1704	373d5524c1a5240b8ca7af560b6b2d75_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\373d5524c1a5240b8ca7af560b6b2d75_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\373d5524c1a5240b8ca7af560b6b2d75_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ewj..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ewj..bat

Filesize
238B

MD5
fe58d4efd4c423ab9dc730d0369aadfa

SHA1
8ee801d7aa4e0fdbedfe675c9dcae539d86b2176

SHA256
4ed83efdf1ebf71160eeedf3f6f23b66fc9afb1eebb3de40e4d76e570f97d489

SHA512
d0e4c1d39bdd463829ccda844d37395203e479f3ddd35e69a9be89e9fcba145ec7f8dcf95006f38b3aff3d802e633c27eb1189380ffabd4efd5f5b2936fb326d

Download Submit
memory/1704-0-0x0000000000130000-0x0000000000147000-memory.dmp

Filesize
92KB

Download
memory/1704-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1704-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download