Analysis
-
max time kernel
145s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 09:15
Static task
static1
Behavioral task
behavioral1
Sample
a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe
-
Size
345KB
-
MD5
a1fba4fc7c545df03dd41273464f5a2e
-
SHA1
2db1c86675229b25fd35bc1e641d74042e370456
-
SHA256
4f5de3312e1ba01d315405cbdb6d708d1d45deb7da4718accc6c92d89cc43bdb
-
SHA512
f6b2506bf491ec587b1534aee2b69658613c5b810b4cc6a04c0eb5aa2dbf5b5574d4ebb4b104393fd80ef8b578b6c0a740cd5872132f37d9e2343191e3e23267
-
SSDEEP
6144:qejcG1q9Y8PbwsZOenCoTh93NphmLAvWkddgcU1y4UwE:qIcG1qjbFOy93fhUeTVU1y4M
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3044 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2736 kotzes.exe -
Loads dropped DLL 3 IoCs
pid Process 3044 cmd.exe 3044 cmd.exe 2736 kotzes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kotzes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3044 cmd.exe 2836 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 2968 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2836 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2968 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2388 wrote to memory of 3044 2388 a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe 30 PID 2388 wrote to memory of 3044 2388 a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe 30 PID 2388 wrote to memory of 3044 2388 a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe 30 PID 2388 wrote to memory of 3044 2388 a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe 30 PID 3044 wrote to memory of 2968 3044 cmd.exe 32 PID 3044 wrote to memory of 2968 3044 cmd.exe 32 PID 3044 wrote to memory of 2968 3044 cmd.exe 32 PID 3044 wrote to memory of 2968 3044 cmd.exe 32 PID 3044 wrote to memory of 2836 3044 cmd.exe 34 PID 3044 wrote to memory of 2836 3044 cmd.exe 34 PID 3044 wrote to memory of 2836 3044 cmd.exe 34 PID 3044 wrote to memory of 2836 3044 cmd.exe 34 PID 3044 wrote to memory of 2736 3044 cmd.exe 35 PID 3044 wrote to memory of 2736 3044 cmd.exe 35 PID 3044 wrote to memory of 2736 3044 cmd.exe 35 PID 3044 wrote to memory of 2736 3044 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2388 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\kotzes.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 23883⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2836
-
-
C:\Users\Admin\AppData\Local\kotzes.exeC:\Users\Admin\AppData\Local\kotzes.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2736
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
345KB
MD5a1fba4fc7c545df03dd41273464f5a2e
SHA12db1c86675229b25fd35bc1e641d74042e370456
SHA2564f5de3312e1ba01d315405cbdb6d708d1d45deb7da4718accc6c92d89cc43bdb
SHA512f6b2506bf491ec587b1534aee2b69658613c5b810b4cc6a04c0eb5aa2dbf5b5574d4ebb4b104393fd80ef8b578b6c0a740cd5872132f37d9e2343191e3e23267