Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2024, 19:00

General

  • Target

    a7d7225f07f69835b236240527461666_JaffaCakes118.exe

  • Size

    14KB

  • MD5

    a7d7225f07f69835b236240527461666

  • SHA1

    12876011f9e8ce346b70d5dc8d85728ea72be54d

  • SHA256

    d4d29b09a20f3899ad3ec2fe81e825b42ba6839bfe55502fd0624ef8e816d06b

  • SHA512

    fd11f3f9ace7912540c3bd0083b531d21f7bb77446a6e5c1f7449a11934756678de2db6567dcd0ece47840d81ad0ac0c2abc1ab95be289ef866cfb91fc25a331

  • SSDEEP

    384:mNW/W5FGOu7H8/D9X9wj6gHxPO/uS8i9Puej0rV:oWHqD9V2xPK89ej0rV

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7d7225f07f69835b236240527461666_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a7d7225f07f69835b236240527461666_JaffaCakes118.exe"
    1⤵
    • Sets service image path in registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\system32\delme.bat
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2800
  • C:\Windows\SysWOW64\A6706365.EXE
    C:\Windows\SysWOW64\A6706365.EXE -k
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2660

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\A6706365.EXE

          Filesize

          14KB

          MD5

          a7d7225f07f69835b236240527461666

          SHA1

          12876011f9e8ce346b70d5dc8d85728ea72be54d

          SHA256

          d4d29b09a20f3899ad3ec2fe81e825b42ba6839bfe55502fd0624ef8e816d06b

          SHA512

          fd11f3f9ace7912540c3bd0083b531d21f7bb77446a6e5c1f7449a11934756678de2db6567dcd0ece47840d81ad0ac0c2abc1ab95be289ef866cfb91fc25a331

        • C:\Windows\SysWOW64\delme.bat

          Filesize

          239B

          MD5

          5ae0aaef4c809474958f9d1c46e2372f

          SHA1

          e9f065ef7fb2c4149b8ada31ddb3efde4942c23c

          SHA256

          973cb721d4f7cbc8a30c87b8de099476fa6050f5c709273c1c9ecc99b0f6a385

          SHA512

          d554b7c27c760f891ad1f4ad1322488829838cafe76bb1e98c4b0381c9af8a8c70147d0e6a874a9f8bb9010b580f017eca106ed40b05e8092fc0ab124ce66d71

        • memory/2660-4-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

        • memory/2660-16-0x0000000000400000-0x0000000000416000-memory.dmp

          Filesize

          88KB

        • memory/2840-0-0x0000000000400000-0x0000000000416000-memory.dmp

          Filesize

          88KB

        • memory/2840-1-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

        • memory/2840-14-0x0000000000400000-0x0000000000416000-memory.dmp

          Filesize

          88KB