Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 05:58
General
-
Target
eab67ce0abea1d78963bfb9078d37736_JaffaCakes118.exe
-
Size
96KB
-
MD5
eab67ce0abea1d78963bfb9078d37736
-
SHA1
768a411fe89654c6cb7f59a76506058b8f689002
-
SHA256
a2f8a0bd595764dc576197c9c884b5f4a37febfa8e1d80e9af6ec37f7394d321
-
SHA512
430205dd38d6cc21ee71e9e427995902331d10e2967ee174eedae870de5d460463d6a1ea2c141021092f077ee793744c616c91951b76dd6817c491d3aa6650f0
-
SSDEEP
768:sqQoj/dSzNVQ1mDNJWbKEdBMQXQ3Cn4eQQercwxsRf:RQoj/YNJcAQeMJ
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
griptoloji - Password:
741852
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eab67ce0abea1d78963bfb9078d37736_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eab67ce0abea1d78963bfb9078d37736_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Java\jre-19\bin\jusched.exe"C:\Program Files (x86)\Java\jre-19\bin\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
96KB
MD5dfbe61427b6ef4bbd99fb435a330e49e
SHA13443cade8ae8500758244f6955f5ebca7dc3d2c6
SHA25697218f4e8d19fcdd9f4a0880b0422e860d3c0983ee18969b1f1937fcd476278f
SHA512da9ddb9130a94e713b44618c119e3ba951bd029fb1ae28d7d7d276a8c2a82c425ae830a5e68214c43783be38b62dbf2cc24337ab9ddfa1fc01ef921dcae9ae7f
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB