Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12-10-2024 10:38
Behavioral task
behavioral1
Sample
3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe
-
Size
195KB
-
MD5
3990f4b65ff91e1b5b56517fb2a6a7fc
-
SHA1
ced7cf4d1a7293a6d2d475a1ebaff79f9d663840
-
SHA256
92d5d96b775b95f06d4d5d27e063cc187f7af38fbf24f9314e5ed199da3ef8f1
-
SHA512
ff154d3f5e2053a0ee891f97905b9c46f671b600497317dc3daccbe31e21330af9af96389ff0357b98cb7b9395da281251489c552ddcc1087e1c6a5f411e4f80
-
SSDEEP
3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhUK:gExhk7rh7NEOIYWlPM6r6UK
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2300 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 2080 biudfw.exe -
Loads dropped DLL 1 IoCs
Processes:
3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exepid process 1864 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
biudfw.execmd.exe3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exedescription pid process target process PID 1864 wrote to memory of 2080 1864 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe biudfw.exe PID 1864 wrote to memory of 2080 1864 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe biudfw.exe PID 1864 wrote to memory of 2080 1864 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe biudfw.exe PID 1864 wrote to memory of 2080 1864 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe biudfw.exe PID 1864 wrote to memory of 2300 1864 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe cmd.exe PID 1864 wrote to memory of 2300 1864 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe cmd.exe PID 1864 wrote to memory of 2300 1864 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe cmd.exe PID 1864 wrote to memory of 2300 1864 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2080
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD52776cde4761cefd1198f4712989957b1
SHA1c801245a080524e704e8e3da95700e58e9d1ca3c
SHA25669ca5964abf7f1c054541bcc32f2712d3fa51342913affed5023825e3dca521f
SHA512bdc242f5c69d10cbfa903bbf20448a9e93213ee303091f1ae9ff8d29c83250168491d9b553841f8ed9b756aef29c499eea3562ff9f94b5619012eb21d5d88c4a
-
Filesize
302B
MD59f977c7bb354748c9f15380bc18f9b70
SHA1b6db88571b919696f56d314af7f44a57c391e92f
SHA25693194f3a481301602ebbd785c024a6b6b1b315164dcd6a4a02956223e2c75bfd
SHA5123ad6f01bfad9c29b8a8c789ff2defc5f4cdb6833af900937eebf5d30b94c6f6e2004c8e6106d5d3d7bfb6ef5fd9123ccd67743f13ce0cb2631f9743d6cb94c72
-
Filesize
195KB
MD507e5cb573a04819b5e2e6a70637840c8
SHA148d7fb59ac0d0162fce21d33a994f74768e14794
SHA256f939234e5293fb3758d688ae979429681e4c2ebe9ec4b3625591aa22fdfa2d10
SHA5120b2272df2a94834db264bbc92b74226fcda865bd54033703377d3373d741615804f9e8e53e594b5057c83aab0d4decf3dca3c92b5efcb48df11525bfba2ae18b