Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 16:31
Behavioral task
behavioral1
Sample
86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe
-
Size
13KB
-
MD5
86cf96a102709afda15710cfbfd00019
-
SHA1
deca5a44083ffb68eb2b7f87afb6eacbd364fd3c
-
SHA256
bd3028764d71a2b618020c93efc84bf3254587063e0037d6e667b81f3697274d
-
SHA512
816138e7fcdb2632c92ecf3a62a978ddd97e9343202477053069ddb6dd82bba80ab10c8769068c0ce697973194c8cf537d78e086d3a188021d8fd9a584975f8d
-
SSDEEP
384:peoiXE6cletE9EijfZETgknvJ4YA0MuxikDg:ViU19EiZ+gkvOYldw
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Deletes itself 1 IoCs
pid Process 264 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2752 baccopsk.exe -
Loads dropped DLL 2 IoCs
pid Process 2880 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe 2880 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2880-0-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/files/0x0008000000018ba5-3.dat upx behavioral1/memory/2752-12-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2880-13-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\baccops.dll 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe File created C:\Windows\SysWOW64\baccopsk.exe 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\baccopsk.exe 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2752 2880 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe 30 PID 2880 wrote to memory of 2752 2880 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe 30 PID 2880 wrote to memory of 2752 2880 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe 30 PID 2880 wrote to memory of 2752 2880 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe 30 PID 2880 wrote to memory of 264 2880 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe 32 PID 2880 wrote to memory of 264 2880 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe 32 PID 2880 wrote to memory of 264 2880 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe 32 PID 2880 wrote to memory of 264 2880 86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\baccopsk.exeC:\Windows\system32\baccopsk.exe ˜‰2⤵
- Executes dropped EXE
PID:2752
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\86cf96a102709afda15710cfbfd00019_JaffaCakes118.exe.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD5a546941ff9a2c74318e466d9e6a8299c
SHA106c0cffe0432446f59508a5ab4cb53db2e6fc0a2
SHA256df3f76bc43375e82d4b095fd267a854419081d5a91f8d303bb75ea1af651b53c
SHA51216a9a82f80da5f95b1cce984401ec65265d7a99f96a0648ff2f8ef7a4022bced24920d343d827c8bab6d0b7306cd1d605676fda00dab05c47655d3db72233827
-
Filesize
13KB
MD586cf96a102709afda15710cfbfd00019
SHA1deca5a44083ffb68eb2b7f87afb6eacbd364fd3c
SHA256bd3028764d71a2b618020c93efc84bf3254587063e0037d6e667b81f3697274d
SHA512816138e7fcdb2632c92ecf3a62a978ddd97e9343202477053069ddb6dd82bba80ab10c8769068c0ce697973194c8cf537d78e086d3a188021d8fd9a584975f8d