29b971eec549dda3b73c216041d06b6ffdb26f9466e8f3a410ee7caf5501bff5

Analysis

max time kernel
16s
max time network
21s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 04:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37b9949afcdc5c1870ad1c7bbe2179d3_JaffaCakes118.exe
Size

16KB
MD5

37b9949afcdc5c1870ad1c7bbe2179d3
SHA1

14cd4f9270cdb92fd512a568bd2cfc5d81ba5cce
SHA256

29b971eec549dda3b73c216041d06b6ffdb26f9466e8f3a410ee7caf5501bff5
SHA512

a50cd42baeeb4ac226ac4450783a26c36fe15bfbffaec9f1609d225d67711868768586396abc59143a213542686d41ada57b40669cbbb22ffb2807b9b6bb094d
SSDEEP

192:Jvdm/oQCG50PrTw2+4cDI2E8DsL9dxdJMwmBEW9YG:tdJHc2Tlc02E8DSLbJMqWCG

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2640	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2992	2260	37b9949afcdc5c1870ad1c7bbe2179d3_JaffaCakes118.exe	30
PID 2260 wrote to memory of 2992	2260	37b9949afcdc5c1870ad1c7bbe2179d3_JaffaCakes118.exe	30
PID 2260 wrote to memory of 2992	2260	37b9949afcdc5c1870ad1c7bbe2179d3_JaffaCakes118.exe	30
PID 2260 wrote to memory of 2992	2260	37b9949afcdc5c1870ad1c7bbe2179d3_JaffaCakes118.exe	30
PID 2260 wrote to memory of 2640	2260	37b9949afcdc5c1870ad1c7bbe2179d3_JaffaCakes118.exe	33
PID 2260 wrote to memory of 2640	2260	37b9949afcdc5c1870ad1c7bbe2179d3_JaffaCakes118.exe	33
PID 2260 wrote to memory of 2640	2260	37b9949afcdc5c1870ad1c7bbe2179d3_JaffaCakes118.exe	33
PID 2260 wrote to memory of 2640	2260	37b9949afcdc5c1870ad1c7bbe2179d3_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\37b9949afcdc5c1870ad1c7bbe2179d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37b9949afcdc5c1870ad1c7bbe2179d3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\*.dll
  2⤵
  PID:2992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\gllo.bat C:\Users\Admin\AppData\Local\Temp\37b9949afcdc5c1870ad1c7bbe2179d3_JaffaCakes118.exe
  2⤵
  - Deletes itself
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gllo.bat

Filesize
70B

MD5
677931564938373367422e56cdf23934

SHA1
fb077020992d9fa49a901d3b64c3d9ce5bb88b35

SHA256
2d8efe1526fa203539bc77da8570b4cb38d5a63836a76d2379b7b506d0a67ee0

SHA512
808e177716911a5b975449b55df4fe1fc97cdb929be621fe541a7dfe7dce3362039214fe1ab4760c4d67aafe8a12308d04e5a40dc028b848c154f3e3f2d120ba

Download Submit