cf47769cbd41124b5f12ca9624a12339a52a9613f64a562208901cc330814896

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2c3a77f36bf005a3eba9acf58a40ac1_JaffaCakes118.exe
Size

4.2MB
MD5

b2c3a77f36bf005a3eba9acf58a40ac1
SHA1

e4dfb61f8a69e333ef43129b221898cfae8d67f9
SHA256

cf47769cbd41124b5f12ca9624a12339a52a9613f64a562208901cc330814896
SHA512

0d03a5384a602d52b94e493ffce365ccfcee4242538c73295cc1a23fc21c530f9b2a0950034cc259925778aaff1faad0df18e875758c25c5bd2884b6feba3ace
SSDEEP

98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4ulub:ovsJR0TW6yiIKRhzqOsb

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2948	IQODQ.exe

Executes dropped EXE 1 IoCs

pid	Process
2948	IQODQ.exe

Loads dropped DLL 2 IoCs

pid	Process
1936	b2c3a77f36bf005a3eba9acf58a40ac1_JaffaCakes118.exe
2948	IQODQ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2948	IQODQ.exe
2948	IQODQ.exe
2948	IQODQ.exe
2948	IQODQ.exe
2948	IQODQ.exe
2948	IQODQ.exe
2948	IQODQ.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	b2c3a77f36bf005a3eba9acf58a40ac1_JaffaCakes118.exe
Token: 0	1936	b2c3a77f36bf005a3eba9acf58a40ac1_JaffaCakes118.exe
Token: SeDebugPrivilege	2948	IQODQ.exe
Token: 0	2948	IQODQ.exe
Token: SeShutdownPrivilege	2948	IQODQ.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2948	1936	b2c3a77f36bf005a3eba9acf58a40ac1_JaffaCakes118.exe	30
PID 1936 wrote to memory of 2948	1936	b2c3a77f36bf005a3eba9acf58a40ac1_JaffaCakes118.exe	30
PID 1936 wrote to memory of 2948	1936	b2c3a77f36bf005a3eba9acf58a40ac1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\b2c3a77f36bf005a3eba9acf58a40ac1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2c3a77f36bf005a3eba9acf58a40ac1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\IQODQ.exe
  "C:\Users\Admin\AppData\Local\Temp\IQODQ.exe" -Continue|"C:\Users\Admin\AppData\Local\Temp\b2c3a77f36bf005a3eba9acf58a40ac1_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DIH\VAC.zip

Filesize
13KB

MD5
5a8e8dedf1d910c79defff5638978d07

SHA1
bfab518af8a53f02c4f98fc321aa0984a208686c

SHA256
d5bf8619a6f47e74aceb629da039f25493b0b8fb2f892bda2b32bd68c0cf8893

SHA512
7acfc4d0bde75a518f394319c8cd6743d36eb7ebcdcd26eeae2fb59ead70bb8b4d2fb29be93c89b529775f8a407a9bcd6e4d2a2955c03b15f2880ff9aa61a519

Download Submit
C:\Users\Admin\AppData\Local\Temp\IQODQ.exe

Filesize
4.2MB

MD5
e5ade9b527212b1f474506fa083332fe

SHA1
e7c4081870e17cf784d5b98793c70ba010321ac9

SHA256
c891e80d733e34d0c82a6e1387f46a8fadf7b28d3bc7fd74d4757e22eb761256

SHA512
fdbfb03edc8f0e06d8e22650390886f82e7a57f724856c7e5173157fdb7bb3d70c662d836bdf9712b521f531e3e75e24245b946dc7f05826973139b9fcf63e0a

Download Submit
\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x64\SciLexer.dll

Filesize
1.3MB

MD5
a70486cf41bf065ff8e76e8619745361

SHA1
e06e75380b17fec737fbdfeaa4a09b83e54d4838

SHA256
1563fc1966e779f0fcb71753f15e73ec770e169a0ad6e3c5af736764d9bd5858

SHA512
02f1c909fcbf7c0f5604ccb4e807640d80a2236c3cac6975e2e849bda318419e7188bb6a48184940eb381e2af375c83d7539e58951edf5e49ec11dd0cff66cc0

Download Submit
memory/1936-10-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/1936-2-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/1936-4-0x00000000011C0000-0x0000000001202000-memory.dmp

Filesize
264KB

Download
memory/1936-6-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/1936-3-0x000000001C380000-0x000000001C460000-memory.dmp

Filesize
896KB

Download
memory/1936-0-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download
memory/1936-11-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/1936-5-0x000000001C6D0000-0x000000001C824000-memory.dmp

Filesize
1.3MB

Download
memory/1936-1-0x0000000001360000-0x0000000001796000-memory.dmp

Filesize
4.2MB

Download
memory/1936-24-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-26-0x0000000000B40000-0x0000000000F76000-memory.dmp

Filesize
4.2MB

Download
memory/2948-27-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-25-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-31-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-32-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-33-0x000000001B180000-0x000000001B198000-memory.dmp

Filesize
96KB

Download