dd520038acba89fcec9dfcbbabe3bfb7d3a1c21f6c26333f14729875c0e050ae

Analysis

max time kernel
147s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe
Size

240KB
MD5

40336bbff8e9f7f050d4ac8fcf99bc43
SHA1

3692aaa550384f974e45b6ad28277a2ccda0043b
SHA256

dd520038acba89fcec9dfcbbabe3bfb7d3a1c21f6c26333f14729875c0e050ae
SHA512

088e95f4b0144db5f327686a7f41d6a735f8cfaa9bb0c95f939a7668a11f1f476476674b68597877cb03841725db2442717c0aab70e0b817046bf4034adc7a1c
SSDEEP

6144:n/6CVtDl8moKu4s8GL+nB9WBfAW5xESHpoh+rbbjZpa01Y:nCCDl8jxSn785uOc+HbjZ0

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2696	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2388	fck.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\fck.exe	40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe
File opened for modification	C:\Windows\fck.exe	40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe
File created	C:\Windows\Delete.bat	40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	fck.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	fck.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	fck.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	fck.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	fck.exe
Key created	\REGISTRY\USER\.DEFAULT\System	fck.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	fck.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	fck.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	fck.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	fck.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2696	2900	40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe	31
PID 2900 wrote to memory of 2696	2900	40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe	31
PID 2900 wrote to memory of 2696	2900	40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe	31
PID 2900 wrote to memory of 2696	2900	40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Delete.bat
  2⤵
  - Deletes itself
  PID:2696

C:\Windows\fck.exe
C:\Windows\fck.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
PID:2388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.bat

Filesize
214B

MD5
d6bddd86f0e57974ea18702d78d848bd

SHA1
2db0ceb2745f5eb59391c845cbee010699cae0e4

SHA256
8dd35fce13f3392537c1788786fd935491e52edb57635739f724b09012aec56d

SHA512
1a74ab8bbc745cb93da524f7e1849e96892fdee45313aee292183d4d04d7d6576d6fa923ac398fb617b849628fd599a9f6fa8b98e3b01c4f343daa84b1456e54

Download Submit
C:\Windows\fck.exe

Filesize
240KB

MD5
40336bbff8e9f7f050d4ac8fcf99bc43

SHA1
3692aaa550384f974e45b6ad28277a2ccda0043b

SHA256
dd520038acba89fcec9dfcbbabe3bfb7d3a1c21f6c26333f14729875c0e050ae

SHA512
088e95f4b0144db5f327686a7f41d6a735f8cfaa9bb0c95f939a7668a11f1f476476674b68597877cb03841725db2442717c0aab70e0b817046bf4034adc7a1c

Download Submit
memory/2388-7-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2388-8-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2388-9-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2388-20-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2388-21-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2900-1-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2900-0-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2900-2-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2900-5-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2900-17-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download