Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 19:00
Static task
static1
Behavioral task
behavioral1
Sample
a7d7225f07f69835b236240527461666_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a7d7225f07f69835b236240527461666_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a7d7225f07f69835b236240527461666_JaffaCakes118.exe
-
Size
14KB
-
MD5
a7d7225f07f69835b236240527461666
-
SHA1
12876011f9e8ce346b70d5dc8d85728ea72be54d
-
SHA256
d4d29b09a20f3899ad3ec2fe81e825b42ba6839bfe55502fd0624ef8e816d06b
-
SHA512
fd11f3f9ace7912540c3bd0083b531d21f7bb77446a6e5c1f7449a11934756678de2db6567dcd0ece47840d81ad0ac0c2abc1ab95be289ef866cfb91fc25a331
-
SSDEEP
384:mNW/W5FGOu7H8/D9X9wj6gHxPO/uS8i9Puej0rV:oWHqD9V2xPK89ej0rV
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\B30FDAF5\ImagePath = "C:\\Windows\\system32\\A6706365.EXE -k" a7d7225f07f69835b236240527461666_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 2800 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2660 A6706365.EXE -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\A6706365.EXE a7d7225f07f69835b236240527461666_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\A6706365.EXE a7d7225f07f69835b236240527461666_JaffaCakes118.exe File created C:\Windows\SysWOW64\A6706365.EXE A6706365.EXE File created C:\Windows\SysWOW64\delme.bat a7d7225f07f69835b236240527461666_JaffaCakes118.exe File created C:\Windows\SysWOW64\A4127CFA.DLL A6706365.EXE -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a7d7225f07f69835b236240527461666_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6706365.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2840 a7d7225f07f69835b236240527461666_JaffaCakes118.exe 2660 A6706365.EXE 2660 A6706365.EXE 2660 A6706365.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2800 2840 a7d7225f07f69835b236240527461666_JaffaCakes118.exe 31 PID 2840 wrote to memory of 2800 2840 a7d7225f07f69835b236240527461666_JaffaCakes118.exe 31 PID 2840 wrote to memory of 2800 2840 a7d7225f07f69835b236240527461666_JaffaCakes118.exe 31 PID 2840 wrote to memory of 2800 2840 a7d7225f07f69835b236240527461666_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7d7225f07f69835b236240527461666_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7d7225f07f69835b236240527461666_JaffaCakes118.exe"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\delme.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2800
-
-
C:\Windows\SysWOW64\A6706365.EXEC:\Windows\SysWOW64\A6706365.EXE -k1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5a7d7225f07f69835b236240527461666
SHA112876011f9e8ce346b70d5dc8d85728ea72be54d
SHA256d4d29b09a20f3899ad3ec2fe81e825b42ba6839bfe55502fd0624ef8e816d06b
SHA512fd11f3f9ace7912540c3bd0083b531d21f7bb77446a6e5c1f7449a11934756678de2db6567dcd0ece47840d81ad0ac0c2abc1ab95be289ef866cfb91fc25a331
-
Filesize
239B
MD55ae0aaef4c809474958f9d1c46e2372f
SHA1e9f065ef7fb2c4149b8ada31ddb3efde4942c23c
SHA256973cb721d4f7cbc8a30c87b8de099476fa6050f5c709273c1c9ecc99b0f6a385
SHA512d554b7c27c760f891ad1f4ad1322488829838cafe76bb1e98c4b0381c9af8a8c70147d0e6a874a9f8bb9010b580f017eca106ed40b05e8092fc0ab124ce66d71