Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
06-09-2024 08:08
Static task
static1
Behavioral task
behavioral1
Sample
cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe
-
Size
90KB
-
MD5
cf1385e6230b67fad8021b96787891e2
-
SHA1
e0caaaf052092676d0d948e0ff3c682ff170128b
-
SHA256
f9d5e40276d4ce6dd36397bb67056842e866a5654616610b2198133e46ca6c0a
-
SHA512
e6c244ed6ad42da9636c76c6487b5d4b2cd59cdbbc232ca068e920f6021542478bc132eaca3479d4397bbf4ca448cb09818949ef5f2746dd2b01f64ce9e07103
-
SSDEEP
1536:i1dtGmlhGdz2IacJa3u9dfOv919D2AzKUvhWRx0q0cnfRCGRlfXVAG80x5gcR4+t:i1dtGmlhGh2I43ubOvXt2I4Kq0cnjRlv
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2416 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2416 2500 cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe 31 PID 2500 wrote to memory of 2416 2500 cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe 31 PID 2500 wrote to memory of 2416 2500 cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe 31 PID 2500 wrote to memory of 2416 2500 cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ubj..bat" > nul 2> nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2416
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238B
MD5e8f7c27273bab8a43794715ec03339f4
SHA13d56b5f948cfa1c1260cb9fc3b71aca2963a84ae
SHA2563c6a03ebec50db061e0b64763ef379925d091624566c8da32c8f5ff0914a989e
SHA512f34d56fd1846727cfc61249366a30c5067608fe551cebe4117c333e8ec45a7f00c8dc173fb404997d5dbd427d11140b80ec5952bae8571042762339416f1d653