d19fa36b5d234adddf3326a9c2e7a7eecdfc64896d76a2a2bf32721145e55c98

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b66c0ce704d19fd10e9c4c266961601_JaffaCakes118.exe
Size

79KB
MD5

5b66c0ce704d19fd10e9c4c266961601
SHA1

7b54b64c006d1e624acb16c254ff43c4b9bad680
SHA256

d19fa36b5d234adddf3326a9c2e7a7eecdfc64896d76a2a2bf32721145e55c98
SHA512

2217903cd278b208b7e65108abe708c9ea80f1ba09145e71c1b4ee49f4f69ea62593aac8945941ae17a6aff85768c62b5ed9de3b6037225d859823becd53644c
SSDEEP

1536:DS0ZkK2X8rPHtVm/rKSPi9wmJCjphJCpU8AGTYx1zBahhT:DSUkxXUHyu4MlI1h0pU8AGYxZBahh

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2272	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2376	5b66c0ce704d19fd10e9c4c266961601_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2272	2376	5b66c0ce704d19fd10e9c4c266961601_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2272	2376	5b66c0ce704d19fd10e9c4c266961601_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2272	2376	5b66c0ce704d19fd10e9c4c266961601_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2272	2376	5b66c0ce704d19fd10e9c4c266961601_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5b66c0ce704d19fd10e9c4c266961601_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b66c0ce704d19fd10e9c4c266961601_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Omj..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Omj..bat

Filesize
238B

MD5
9dc984333941236bc7eb4ec5057b8275

SHA1
e9be45278b85df450406da9dbe0e0d85dba08df8

SHA256
9bbeb4ad50649086206e091c0c28f7878e2ba94746bd624939f2248287628136

SHA512
c248c5b1e2e8afed91f730f67c61aaaef939f7a6edab99cdfa4e0afaaa80268f18482ba115c981d3f4b27d0e421f673ad3dc22c6c5ca450bde7fc847434c9512

Download Submit
memory/2376-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2376-1-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2376-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2376-3-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2376-6-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download