Analysis
-
max time kernel
209s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 14:10
Static task
static1
Behavioral task
behavioral1
Sample
f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe
-
Size
13KB
-
MD5
f5f40657d309a0ea205244a2a23e1c39
-
SHA1
062e77b9b7d716ee1d4f89b19fdb5eb76de0d6ca
-
SHA256
1d22294427d545d706834a2fc6144d57ebb35a22a4f1609fb667dbbba240d37b
-
SHA512
e320810fc1b6ce5d8e0bfc3b4eec4550a181d221d8f0ca782a45feba9c7c1b1509b2dc6d994033b2289ce2dacead88b17ca0f75bae86d59e420401ca64f9689d
-
SSDEEP
384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjK7aylryylFyylYLlmylylyy8yyCJ:v+dAURFxna4QAPQlYg7aylryylFyylY2
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 2116 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exepid process 2500 f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe 2500 f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exedescription pid process target process PID 2500 wrote to memory of 2116 2500 f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe szgfw.exe PID 2500 wrote to memory of 2116 2500 f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe szgfw.exe PID 2500 wrote to memory of 2116 2500 f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe szgfw.exe PID 2500 wrote to memory of 2116 2500 f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\szgfw.exeFilesize
13KB
MD5686b973e8bd961928a0cdf19fc90c2e5
SHA14dd04102ff3100e27c48fe27a966c7e452e314a2
SHA2567c69afe9f12c660a965c8ce01e6e8981b78d7e9ad745bce9120a083a13cfb84b
SHA512c946c45d475be294aff8a61dafffb29ec142d102a043d915cf5b3aa6573175c3445d2517d5e6e14caf44f4626d7160cf4798cafe88977d0b4cd486a399ed55e8