0716ba730ec712718847f3ddee1a39895c926b5a1b9ab5f7efe87ef1b9ffca0f

Analysis

max time kernel
149s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66e58f657eefd99c453ea3612ffddfc8_JaffaCakes118.exe
Size

299KB
MD5

66e58f657eefd99c453ea3612ffddfc8
SHA1

9bd7e61baa324e6ddd93ba6111f16f3e57231386
SHA256

0716ba730ec712718847f3ddee1a39895c926b5a1b9ab5f7efe87ef1b9ffca0f
SHA512

bcd311d46784f781b6a14e9f8a5fc4a9d39cf83d7660a462a96a080f67ca56bb804cfa1f1e79bb76fee2a5f27b5085e12e9ae055e34262832a3636b436023b14
SSDEEP

3072:o0QGrOCPFzLsuEzgTFeP4JKP6u8dFF863C9TP9SZi+hYtYWdO6oUbvVZutgYZiUF:WUFzwuwSM4jXVExcS9DMgADh3J0c

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2080	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2896	ksigxdj.exe

Loads dropped DLL 3 IoCs

pid	Process
2080	cmd.exe
2080	cmd.exe
2896	ksigxdj.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1108	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2888	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	taskkill.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe
2896	ksigxdj.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2080	1960	66e58f657eefd99c453ea3612ffddfc8_JaffaCakes118.exe	30
PID 1960 wrote to memory of 2080	1960	66e58f657eefd99c453ea3612ffddfc8_JaffaCakes118.exe	30
PID 1960 wrote to memory of 2080	1960	66e58f657eefd99c453ea3612ffddfc8_JaffaCakes118.exe	30
PID 1960 wrote to memory of 2080	1960	66e58f657eefd99c453ea3612ffddfc8_JaffaCakes118.exe	30
PID 2080 wrote to memory of 1108	2080	cmd.exe	32
PID 2080 wrote to memory of 1108	2080	cmd.exe	32
PID 2080 wrote to memory of 1108	2080	cmd.exe	32
PID 2080 wrote to memory of 1108	2080	cmd.exe	32
PID 2080 wrote to memory of 2888	2080	cmd.exe	34
PID 2080 wrote to memory of 2888	2080	cmd.exe	34
PID 2080 wrote to memory of 2888	2080	cmd.exe	34
PID 2080 wrote to memory of 2888	2080	cmd.exe	34
PID 2080 wrote to memory of 2896	2080	cmd.exe	35
PID 2080 wrote to memory of 2896	2080	cmd.exe	35
PID 2080 wrote to memory of 2896	2080	cmd.exe	35
PID 2080 wrote to memory of 2896	2080	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\66e58f657eefd99c453ea3612ffddfc8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\66e58f657eefd99c453ea3612ffddfc8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1960 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\66e58f657eefd99c453ea3612ffddfc8_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\ksigxdj.exe -f
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 1960
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:2888
- - C:\Users\Admin\AppData\Local\ksigxdj.exe
    C:\Users\Admin\AppData\Local\ksigxdj.exe -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\ksigxdj.exe

Filesize
299KB

MD5
66e58f657eefd99c453ea3612ffddfc8

SHA1
9bd7e61baa324e6ddd93ba6111f16f3e57231386

SHA256
0716ba730ec712718847f3ddee1a39895c926b5a1b9ab5f7efe87ef1b9ffca0f

SHA512
bcd311d46784f781b6a14e9f8a5fc4a9d39cf83d7660a462a96a080f67ca56bb804cfa1f1e79bb76fee2a5f27b5085e12e9ae055e34262832a3636b436023b14

Download Submit
memory/1960-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1960-1-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/1960-4-0x0000000001001000-0x00000000010A2000-memory.dmp

Filesize
644KB

Download
memory/1960-0-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/1960-5-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/1960-8-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/1960-7-0x0000000001001000-0x00000000010A2000-memory.dmp

Filesize
644KB

Download
memory/2896-17-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/2896-22-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/2896-13-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/2896-18-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/2896-19-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/2896-20-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/2896-21-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/2896-16-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/2896-23-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/2896-24-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/2896-25-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/2896-26-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/2896-27-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/2896-28-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download