Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 00:10
Static task
static1
Behavioral task
behavioral1
Sample
f23d00861ef6d34c79158c12dc8fe503_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f23d00861ef6d34c79158c12dc8fe503_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f23d00861ef6d34c79158c12dc8fe503_JaffaCakes118.exe
-
Size
369KB
-
MD5
f23d00861ef6d34c79158c12dc8fe503
-
SHA1
f862c934d47df8fd9d8788958b34eb28aeab35f3
-
SHA256
cbf537e68db0faba75151f6219eaee109313a023ce0cf624b3ca88b5bdf268a7
-
SHA512
ed36554bce46f3e62faf4a54a7f71b039d684d6a28d5ee2491457e42ea3257c208b7a1476b226984fb48d4267b966925f520cb6e3b24bddb19300da85a294fc4
-
SSDEEP
6144:mzTJ0OE7eVtJM9hEAjk9TgP7lEP6RTFOQrf3Ex1TtccqQz:SyOE76twhvwK+QTrf3Ebt3qw
Malware Config
Extracted
gcleaner
194.145.227.161
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-2-0x0000000000280000-0x00000000002C9000-memory.dmp family_onlylogger behavioral1/memory/1968-3-0x0000000000400000-0x00000000023C7000-memory.dmp family_onlylogger behavioral1/memory/1968-4-0x0000000000400000-0x00000000023C7000-memory.dmp family_onlylogger -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2224 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2232 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2232 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f23d00861ef6d34c79158c12dc8fe503_JaffaCakes118.execmd.exedescription pid process target process PID 1968 wrote to memory of 2224 1968 f23d00861ef6d34c79158c12dc8fe503_JaffaCakes118.exe cmd.exe PID 1968 wrote to memory of 2224 1968 f23d00861ef6d34c79158c12dc8fe503_JaffaCakes118.exe cmd.exe PID 1968 wrote to memory of 2224 1968 f23d00861ef6d34c79158c12dc8fe503_JaffaCakes118.exe cmd.exe PID 1968 wrote to memory of 2224 1968 f23d00861ef6d34c79158c12dc8fe503_JaffaCakes118.exe cmd.exe PID 2224 wrote to memory of 2232 2224 cmd.exe taskkill.exe PID 2224 wrote to memory of 2232 2224 cmd.exe taskkill.exe PID 2224 wrote to memory of 2232 2224 cmd.exe taskkill.exe PID 2224 wrote to memory of 2232 2224 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f23d00861ef6d34c79158c12dc8fe503_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f23d00861ef6d34c79158c12dc8fe503_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "f23d00861ef6d34c79158c12dc8fe503_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f23d00861ef6d34c79158c12dc8fe503_JaffaCakes118.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "f23d00861ef6d34c79158c12dc8fe503_JaffaCakes118.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1968-2-0x0000000000280000-0x00000000002C9000-memory.dmpFilesize
292KB
-
memory/1968-1-0x00000000002D0000-0x00000000003D0000-memory.dmpFilesize
1024KB
-
memory/1968-3-0x0000000000400000-0x00000000023C7000-memory.dmpFilesize
31.8MB
-
memory/1968-4-0x0000000000400000-0x00000000023C7000-memory.dmpFilesize
31.8MB