Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18-08-2024 19:00

General

  • Target

    a7d7225f07f69835b236240527461666_JaffaCakes118.exe

  • Size

    14KB

  • MD5

    a7d7225f07f69835b236240527461666

  • SHA1

    12876011f9e8ce346b70d5dc8d85728ea72be54d

  • SHA256

    d4d29b09a20f3899ad3ec2fe81e825b42ba6839bfe55502fd0624ef8e816d06b

  • SHA512

    fd11f3f9ace7912540c3bd0083b531d21f7bb77446a6e5c1f7449a11934756678de2db6567dcd0ece47840d81ad0ac0c2abc1ab95be289ef866cfb91fc25a331

  • SSDEEP

    384:mNW/W5FGOu7H8/D9X9wj6gHxPO/uS8i9Puej0rV:oWHqD9V2xPK89ej0rV

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7d7225f07f69835b236240527461666_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a7d7225f07f69835b236240527461666_JaffaCakes118.exe"
    1⤵
    • Sets service image path in registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\system32\delme.bat
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2800
  • C:\Windows\SysWOW64\A6706365.EXE
    C:\Windows\SysWOW64\A6706365.EXE -k
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\A6706365.EXE

    Filesize

    14KB

    MD5

    a7d7225f07f69835b236240527461666

    SHA1

    12876011f9e8ce346b70d5dc8d85728ea72be54d

    SHA256

    d4d29b09a20f3899ad3ec2fe81e825b42ba6839bfe55502fd0624ef8e816d06b

    SHA512

    fd11f3f9ace7912540c3bd0083b531d21f7bb77446a6e5c1f7449a11934756678de2db6567dcd0ece47840d81ad0ac0c2abc1ab95be289ef866cfb91fc25a331

  • C:\Windows\SysWOW64\delme.bat

    Filesize

    239B

    MD5

    5ae0aaef4c809474958f9d1c46e2372f

    SHA1

    e9f065ef7fb2c4149b8ada31ddb3efde4942c23c

    SHA256

    973cb721d4f7cbc8a30c87b8de099476fa6050f5c709273c1c9ecc99b0f6a385

    SHA512

    d554b7c27c760f891ad1f4ad1322488829838cafe76bb1e98c4b0381c9af8a8c70147d0e6a874a9f8bb9010b580f017eca106ed40b05e8092fc0ab124ce66d71

  • memory/2660-4-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2660-16-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2840-0-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2840-1-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2840-14-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB