Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    06-09-2024 08:08

General

  • Target

    cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe

  • Size

    90KB

  • MD5

    cf1385e6230b67fad8021b96787891e2

  • SHA1

    e0caaaf052092676d0d948e0ff3c682ff170128b

  • SHA256

    f9d5e40276d4ce6dd36397bb67056842e866a5654616610b2198133e46ca6c0a

  • SHA512

    e6c244ed6ad42da9636c76c6487b5d4b2cd59cdbbc232ca068e920f6021542478bc132eaca3479d4397bbf4ca448cb09818949ef5f2746dd2b01f64ce9e07103

  • SSDEEP

    1536:i1dtGmlhGdz2IacJa3u9dfOv919D2AzKUvhWRx0q0cnfRCGRlfXVAG80x5gcR4+t:i1dtGmlhGh2I43ubOvXt2I4Kq0cnjRlv

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ubj..bat" > nul 2> nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Ubj..bat

    Filesize

    238B

    MD5

    e8f7c27273bab8a43794715ec03339f4

    SHA1

    3d56b5f948cfa1c1260cb9fc3b71aca2963a84ae

    SHA256

    3c6a03ebec50db061e0b64763ef379925d091624566c8da32c8f5ff0914a989e

    SHA512

    f34d56fd1846727cfc61249366a30c5067608fe551cebe4117c333e8ec45a7f00c8dc173fb404997d5dbd427d11140b80ec5952bae8571042762339416f1d653

  • memory/2500-0-0x0000000000402000-0x0000000000403000-memory.dmp

    Filesize

    4KB

  • memory/2500-1-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2500-2-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2500-3-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2500-6-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB