97bc4caba02f01e3ee43f0b61db691835187fe6c2bcba605c4fedd849fee3f57

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6789957296d98fe0405b27fbf44adaa5_JaffaCakes118.exe
Size

95KB
MD5

6789957296d98fe0405b27fbf44adaa5
SHA1

00c8a64958d980ef8dac8e61c550cda5011ff7f8
SHA256

97bc4caba02f01e3ee43f0b61db691835187fe6c2bcba605c4fedd849fee3f57
SHA512

870a57303676c135b96056e952c3a5db56021af8a244155fcf803b485506d7182865506efa9b97f45698ce37a326f131b2ddd16dd09cc0d6099888d817fd6c9c
SSDEEP

1536:gT3KuCzqahhTbcG0yZnFi0Seu9+2aLWdaAQzqj3D7QpHoSp7wpvFIy:dc0S/9wCdaxzqj3DEeSCpvFIy

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3024	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3024	2356	6789957296d98fe0405b27fbf44adaa5_JaffaCakes118.exe	30
PID 2356 wrote to memory of 3024	2356	6789957296d98fe0405b27fbf44adaa5_JaffaCakes118.exe	30
PID 2356 wrote to memory of 3024	2356	6789957296d98fe0405b27fbf44adaa5_JaffaCakes118.exe	30
PID 2356 wrote to memory of 3024	2356	6789957296d98fe0405b27fbf44adaa5_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\6789957296d98fe0405b27fbf44adaa5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6789957296d98fe0405b27fbf44adaa5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Spz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Spz..bat

Filesize
238B

MD5
cd88e03e7bee7ece2523b862c914ccf1

SHA1
badc1bef3b465002ee5966ddbe9434642a2b370d

SHA256
e0ce8dcf3cd009dd96e3351d0faaadb77ebad7dd5f99e8d3f82c0fb4873bc873

SHA512
2d91ff235f32f575364de8c1697982ae36876b7db33228dd6ca473b2b1ec341e4cc153c0e5facb40fa8c231abca80d1d754ea1ff1464d6d22e0a1a1bb1487b5a

Download Submit
memory/2356-0-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/2356-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2356-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2356-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2356-5-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download