Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-10-2024 20:07
Static task
static1
Behavioral task
behavioral1
Sample
43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe
-
Size
59KB
-
MD5
43f70f6bb37593e40b4943e9e95edf48
-
SHA1
37ad1fce32bca02c1eada6db421f945461dc409b
-
SHA256
7fce64c5c5831ed61df104c4e787fdfc9772fd4dbe8ef1a0f60c679f5bcf16aa
-
SHA512
134ffa376c1ec0f3a43e0e37a140592553ebdf5b4bf591ac331ce5d6a211604a7a533f349d7d6278420bd3646d20edb4c68ebb5a31e60d804ae517878d39e5ce
-
SSDEEP
768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxP5:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdA
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2756 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 2944 biudfw.exe -
Loads dropped DLL 1 IoCs
Processes:
43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exepid process 2084 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
biudfw.execmd.exe43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exedescription pid process target process PID 2084 wrote to memory of 2944 2084 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe biudfw.exe PID 2084 wrote to memory of 2944 2084 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe biudfw.exe PID 2084 wrote to memory of 2944 2084 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe biudfw.exe PID 2084 wrote to memory of 2944 2084 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe biudfw.exe PID 2084 wrote to memory of 2756 2084 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe cmd.exe PID 2084 wrote to memory of 2756 2084 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe cmd.exe PID 2084 wrote to memory of 2756 2084 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe cmd.exe PID 2084 wrote to memory of 2756 2084 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2944
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD555e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1449221fd8d7196a54de2bd583625d8d1b64db56a
SHA256a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
SHA5124af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
-
Filesize
302B
MD518da1fa6e662efbb03311968b810f706
SHA1d36dbdd5ca383a2eb025959877dcc07a95079b06
SHA25695f3230e7dfe567a4ba104380354e09d7e3ff493b14f44314389251082cb772d
SHA5123de0c7d2be6eabdce239e306b5ee011fcddd6ca6f6db820a4e9ea7fa07cd81a777d4aa9082f55548e4938ea70ab43add8afbd3f6b1424977eacf294f6d74cef0
-
Filesize
59KB
MD50473779af26f5598ed09ccb012dcbb43
SHA19c3387cc0a923f4a10a7335245d2d928f61972d6
SHA2563b40a935e381b50395200a63a31c0ed3c7ebb68f65139a9119c082a67ba64936
SHA5124d817fd9f3945fc766c7af8c988e3f0a936cdc8f88f626656e42f6c8b42ce42245c6fe8687e87e1bebe7c390886e38afa7520bc0e0c4e873dd82d1e23f32dbf9