Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 22:38
Static task
static1
Behavioral task
behavioral1
Sample
693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe
-
Size
204KB
-
MD5
693b8d154125c6847bb23914eae6ba6b
-
SHA1
d4d521974ab382452b4893e08b8b97091dfe532a
-
SHA256
3effdcc45ed62fc83729c74b06f7968293e62d8153e122f3c551fc3cfb55fc6d
-
SHA512
11caec3754e5c8f1f4a22894e29585f1c1404c942465fc91c9873bb0a2e60b0d7c2aa825521b6a8ff863227e4022fe0820ddeebfedb8aed9d011a699613403ab
-
SSDEEP
1536:NfAiHwgicnislGltILYLU9KD02BBAdKJaPoYkwA7dIolQ:NfQgicdlGvILcU9KQ2BBAkJaPxsIolQ
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Extracted
Protocol: ftp- Host:
ftp.byethost12.com - Port:
21 - Username:
b12_8082975 - Password:
951753zx
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2460 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 856 693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe 856 693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\50911943\jusched.exe 693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe File created C:\Program Files (x86)\50911943\50911943 693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job 693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 856 wrote to memory of 2460 856 693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe 31 PID 856 wrote to memory of 2460 856 693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe 31 PID 856 wrote to memory of 2460 856 693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe 31 PID 856 wrote to memory of 2460 856 693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\693b8d154125c6847bb23914eae6ba6b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Program Files (x86)\50911943\jusched.exe"C:\Program Files (x86)\50911943\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2460
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD5552bb86ed2797d3fd12ac0d273afaf75
SHA16e8633f9c24590779acbd3dd14c60f856320bc0a
SHA2563ef9ff5da8272fd1b14c83f12c8d28fd9dbf32d56bcb714921032b02557fe789
SHA512dab57227de02f4667cc8e2ec47566088b473caa0387caffbdfde37f3400da7d4f67dd222e83a4fa93592694bbcff7c52a2bcec074868baf221bc47d9370c8d2c
-
Filesize
204KB
MD50f4e30fba989b317853e051beac8cd75
SHA194dd13743e7b96665d645e811aa0717e18b2b1ce
SHA256cf74b1ae04db855fc3994420bf4d7503008c1d6a407e03ba123df365a6158464
SHA5125add53ee912bb86c98510a280001add1edacd1ee3767e98f9b13d2fb110a6ffc52592b2c8ceb70768d6faef11e65b946c3d89937b691e48ec4973a7f7a4ceb64