6c124696cfdf4b7828adb321d4efd51ab93ef664f835ed74f7a0ce90b1267dbe

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe
Size

196KB
MD5

6a2b3495783e35917b88255cf5a713ce
SHA1

bbc466fd21ac4c1f79a42f05dde7d185fbc48481
SHA256

6c124696cfdf4b7828adb321d4efd51ab93ef664f835ed74f7a0ce90b1267dbe
SHA512

f5824157fd7c49c2bc391e75a2f83b4d358fb0a3c3e6f76889a282fb186157198d936b33e84846e5a14b9a93ed90ecc862403adbaf581a914fbb7866a4c3b788
SSDEEP

1536:oXs9wrnUh4d7ygVpn0uv77P11gqu87qhofgT6dBX:oXYw4+dGgLn0sP11gqGofgTeR

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.alizametal.com.tr
Port:
21
Username:
alizametal.com.tr
Password:
hd611

Extracted

Credentials

Protocol: ftp
Host:
ftp.yesimcopy.com
Port:
21
Username:
yesimcopy1
Password:
825cyf

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2804	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
1620	6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe
1620	6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\de37aace\jusched.exe	6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe
File created	C:\Program Files (x86)\de37aace\de37aace	6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe
File created	C:\Program Files (x86)\de37aace\info_a	6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jusched.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2804	1620	6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2804	1620	6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2804	1620	6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2804	1620	6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6a2b3495783e35917b88255cf5a713ce_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files (x86)\de37aace\jusched.exe
  "C:\Program Files (x86)\de37aace\jusched.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\de37aace\de37aace

Filesize
17B

MD5
6ff89798e0e63d75115c777af43a2cd9

SHA1
e8b994ccbbe64951afe91fc3dd377f88fe6c9ba8

SHA256
3b3947957c6e0abb19d91b256521bdb3826d88d9b7b53995e177a58cebf0d479

SHA512
46557f9bf6f5c5b3316891a9b623a7d11d8d8ff1973ca84cfbcf8d898746f2dbded7fee837c9a70c2e36f9b46a357fe2ba53585bf5307950d2fef6ee1dcb28a3

Download Submit
C:\Program Files (x86)\de37aace\info_a

Filesize
12B

MD5
0ba2326a81a6ba4057b6970473c458bb

SHA1
ff2464b8baaf080a9cad06afbbf972329cbd9683

SHA256
d6bc06cc5484a858478536520ae4544688de6fb099aeee016ad8837866096be1

SHA512
d724cd22d6e050d643e3b222919769da91e99ba09419c9875b7e07d882d1ad02e274911fb3e9705ee4c26921b0da4161a41d177fefcdf518febd3f46c1eacadc

Download Submit
\Program Files (x86)\de37aace\jusched.exe

Filesize
196KB

MD5
99a3e23e5e1e2e6d6a170aeda327bde1

SHA1
034be10196ae03826cef8ca6304bdb086f724875

SHA256
6dfeb923cc593293008de1c2e92a4510da78e8b3f0e6c9d30159739e65dc808c

SHA512
054c961c1a8c7f676122022e55fd7e8d9c847a525dc33b239ff7638ec876da908c6755c90bb0f426bb38c279d4304d0372ff430f2908902bdd0d3e61fe0beee3

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads