Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
22/07/2024, 19:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
General
- Target 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe
- Size 434KB
- Sample240722-ycxqcsvamg
- SHA256 01d5f1b32235b5d5ba5970d56639d82aa3d83b57ec08c79b3580fd0c88ef1c29
- MD5 64876d5de7061e925e29f6a0c87cea9b
- SHA1 51d6ed277b85b07974d450a9b3441c780467613f
- SHA512 2dfe245cd058d10ac35c441238c52dcb08db8c565786d5824baf9cbd2846f2a4803709d4e9850add7f4c8e6ea5f37c23c66423820a9d6af2b7da8ddf74b6cb1b
- SSDEEP 12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK9SATTsx/SA/WegYfdNbrqnuv:rXh6XcBXo8TsL8Y8m/ATTySA/DrfdNbV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4352 GetX64BTIT.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 api.ipify.org 24 api.ipify.org - Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1384 wrote to memory of 4352 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 87 PID 1384 wrote to memory of 4352 1384 64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\64876d5de7061e925e29f6a0c87cea9b_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:4352
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
- Size 3KB
- SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
- MD5 b4cd27f2b37665f51eb9fe685ec1d373
- SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
- SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\x64btit.txt
- Size 28B
- SHA256 5221dfe7ef63b4236ed0b6703c8645465cc86339aa7106c28c2eb71d517e99d1
- MD5 46916e9a9d2652fd13cda8d4848df81c
- SHA1 0ef19db22d5e158764769724aa51b5e48160c2a3
- SHA512 fb85dbe1baf4d3b7f436e2af2458aa91168d8a3fa3977745fc756b52911dea29929be6d81f172c380295783683c2f96e6555cc8b89f9a92b419224aad50e1e1f
- MD5 SHA1 SHA512