Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe
-
Size
48KB
-
MD5
a2f78c24593ef4b4660d2adec060acc8
-
SHA1
78489033421f2eb5f325b69c08027778da7d55f6
-
SHA256
26fc7c213cb8ccfad7cef246ba47249b2c800687b4597e817e3a359f06ea1845
-
SHA512
3c47a9d3d9d755a252335e93786c02faa54ee382a3d87c5c4015ef61782adcd9f3569113a0b87681fb128722436246dc88f15d60f0c52a16d061c5f32bafde97
-
SSDEEP
768:oK2f1pfN8B7Zqf+Rbnh5PaUYzdaMIYQz86CHiPiBFTCk9TO7nESmjid1Trqfd0wa:oKgHuNqabn9mk2TC053jQ1Tr22wOMgf
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FA7F4C98\ImagePath = "C:\\Windows\\system32\\1FCF7F23.EXE -FA7F4C98" a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 1916 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2384 1FCF7F23.EXE -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\delme.bat a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe File created C:\Windows\SysWOW64\1FCF7F23.EXE a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\1FCF7F23.EXE a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe File created C:\Windows\SysWOW64\1FCF7F23.EXE 1FCF7F23.EXE File created C:\Windows\SysWOW64\83697D9E.DLL 1FCF7F23.EXE -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FCF7F23.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1700 a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe 2384 1FCF7F23.EXE 2384 1FCF7F23.EXE 2384 1FCF7F23.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 1916 1700 a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe 31 PID 1700 wrote to memory of 1916 1700 a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe 31 PID 1700 wrote to memory of 1916 1700 a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe 31 PID 1700 wrote to memory of 1916 1700 a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a2f78c24593ef4b4660d2adec060acc8_JaffaCakes118.exe"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\delme.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1916
-
-
C:\Windows\SysWOW64\1FCF7F23.EXEC:\Windows\SysWOW64\1FCF7F23.EXE -FA7F4C981⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5a2f78c24593ef4b4660d2adec060acc8
SHA178489033421f2eb5f325b69c08027778da7d55f6
SHA25626fc7c213cb8ccfad7cef246ba47249b2c800687b4597e817e3a359f06ea1845
SHA5123c47a9d3d9d755a252335e93786c02faa54ee382a3d87c5c4015ef61782adcd9f3569113a0b87681fb128722436246dc88f15d60f0c52a16d061c5f32bafde97
-
Filesize
239B
MD523d18900b682d6c7a22eb04281460c82
SHA184ae34a754419c5befb109a43a9fce14773d820e
SHA2562331bc14ed5172d8fcbc81aed5b84d90ebf46398e109b1085a318a0d2ed9614f
SHA5122f5c911cb519edb9c49becf613e94a97e363090caa516df0f9aa9b2e2be3fc157336620db66408f7490c4d98b4e1263db7bcbba1c18dce70c4ada28f9fa356e5