Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 14:48

General

  • Target

    a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe

  • Size

    48KB

  • MD5

    a2f78c24593ef4b4660d2adec060acc8

  • SHA1

    78489033421f2eb5f325b69c08027778da7d55f6

  • SHA256

    26fc7c213cb8ccfad7cef246ba47249b2c800687b4597e817e3a359f06ea1845

  • SHA512

    3c47a9d3d9d755a252335e93786c02faa54ee382a3d87c5c4015ef61782adcd9f3569113a0b87681fb128722436246dc88f15d60f0c52a16d061c5f32bafde97

  • SSDEEP

    768:oK2f1pfN8B7Zqf+Rbnh5PaUYzdaMIYQz86CHiPiBFTCk9TO7nESmjid1Trqfd0wa:oKgHuNqabn9mk2TC053jQ1Tr22wOMgf

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe"
    1⤵
    • Sets service image path in registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\system32\delme.bat
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:1916
  • C:\Windows\SysWOW64\1FCF7F23.EXE
    C:\Windows\SysWOW64\1FCF7F23.EXE -FA7F4C98
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\1FCF7F23.EXE

    Filesize

    48KB

    MD5

    a2f78c24593ef4b4660d2adec060acc8

    SHA1

    78489033421f2eb5f325b69c08027778da7d55f6

    SHA256

    26fc7c213cb8ccfad7cef246ba47249b2c800687b4597e817e3a359f06ea1845

    SHA512

    3c47a9d3d9d755a252335e93786c02faa54ee382a3d87c5c4015ef61782adcd9f3569113a0b87681fb128722436246dc88f15d60f0c52a16d061c5f32bafde97

  • C:\Windows\SysWOW64\delme.bat

    Filesize

    239B

    MD5

    23d18900b682d6c7a22eb04281460c82

    SHA1

    84ae34a754419c5befb109a43a9fce14773d820e

    SHA256

    2331bc14ed5172d8fcbc81aed5b84d90ebf46398e109b1085a318a0d2ed9614f

    SHA512

    2f5c911cb519edb9c49becf613e94a97e363090caa516df0f9aa9b2e2be3fc157336620db66408f7490c4d98b4e1263db7bcbba1c18dce70c4ada28f9fa356e5

  • memory/1700-0-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/1700-1-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1700-14-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2384-4-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

  • memory/2384-16-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB