Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 01:04
Static task
static1
Behavioral task
behavioral1
Sample
59d67d15947c1a3aa74be72acae28f06_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
59d67d15947c1a3aa74be72acae28f06_JaffaCakes118.exe
-
Size
91KB
-
MD5
59d67d15947c1a3aa74be72acae28f06
-
SHA1
485f49d4678297e13c45e5db50a838f25395d016
-
SHA256
afeb8c143f41db59cce375f24e5a42c71039662770107de705d8581e1f4182de
-
SHA512
167c323cef1e4525d33caa66e70e73747a14f431e3d8124bf6a43e13d22178c733b8dcc6511e15a9a0a600a016dc218fa2112d1d77877b5642ecd0f7d25c96f9
-
SSDEEP
1536:PcP0dAXzppuzDGC3ItBgM6112sHSc5tA8l6+5dqckhuOvce9jIKC2aUUn/M6Ddb:PcMdAX1kABgjHScfA83WckhuO99jIwtn
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2480 cmd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
59d67d15947c1a3aa74be72acae28f06_JaffaCakes118.exedescription pid process target process PID 1296 wrote to memory of 2480 1296 59d67d15947c1a3aa74be72acae28f06_JaffaCakes118.exe cmd.exe PID 1296 wrote to memory of 2480 1296 59d67d15947c1a3aa74be72acae28f06_JaffaCakes118.exe cmd.exe PID 1296 wrote to memory of 2480 1296 59d67d15947c1a3aa74be72acae28f06_JaffaCakes118.exe cmd.exe PID 1296 wrote to memory of 2480 1296 59d67d15947c1a3aa74be72acae28f06_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\59d67d15947c1a3aa74be72acae28f06_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\59d67d15947c1a3aa74be72acae28f06_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ytk.bat" "C:\Users\Admin\AppData\Local\Temp\59d67d15947c1a3aa74be72acae28f06_JaffaCakes118.exe" "2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ytk.batFilesize
71B
MD5e6b031b9b7d40fa332ebc6f38b2f9f64
SHA1d6dbffcfcc6a26188fd8d2e5b6257af4821fb48f
SHA25666a04ff993916bce61351e4c3b94ea079c806efb1723c7cd79bd32aaf6847e0b
SHA5127d17655334fcda4c3326110d340fd91cd23ee284dec99c3a8bbc8408342fda5f51e27aaba75fba4cccd513c342c22f07ad2cf6e2326ba575e3cc0eba4ea91948
-
memory/1296-0-0x0000000001E60000-0x0000000001E80000-memory.dmpFilesize
128KB
-
memory/1296-1-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1296-10-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1296-11-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB