Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 03:16
Static task
static1
Behavioral task
behavioral1
Sample
5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe
-
Size
918KB
-
MD5
5ce8ca2c99161818ce9f4444da82887f
-
SHA1
5c04d36d4700de9ab5f16d8e4ae8b73b01d5a984
-
SHA256
8b08e73ad310f5e7e06c78b453ff8bc00851d0b9f86fa00c64a3dd42ec1632ce
-
SHA512
475eba06a17037f9258417cfe553359b21d4248a1d6b64c8c603684eee8851ef92d81c1bd2145350fc015673f1d1b4bf5a5b4a1fc2c7b7fc055e66cf73c5ede6
-
SSDEEP
6144:f3bDksaZLLP8OvtzpfzzlPFAAfwG44X0m+Z1Af61g8nKB17M1hRJG:fvksaZLwOvTzRP6Af44ajACi8Kr7M1g
Malware Config
Extracted
qakbot
325.43
abc003
1600093841
134.0.196.46:995
187.200.69.215:443
66.222.88.126:995
151.73.125.102:443
186.94.248.208:2078
71.56.53.127:443
87.65.204.240:995
63.155.74.135:995
68.184.45.73:443
82.77.105.236:2222
23.240.70.80:443
24.138.77.61:443
76.111.128.194:443
75.136.40.155:443
75.182.214.87:443
73.216.60.90:2222
148.240.52.146:443
108.185.113.12:443
216.163.4.136:443
66.215.32.224:443
35.134.202.234:443
84.247.55.190:443
77.159.149.74:443
72.204.242.138:32102
24.27.82.216:2222
207.255.161.8:465
206.183.190.53:993
134.228.24.29:443
96.41.93.96:443
84.232.238.30:443
184.98.103.204:995
72.186.1.237:443
81.133.234.36:2222
189.163.185.110:443
71.84.5.114:995
68.225.56.31:443
108.178.66.82:995
172.87.134.226:443
216.201.162.158:443
67.6.55.77:443
76.170.77.99:995
94.53.92.42:443
74.195.88.59:995
64.121.114.87:443
166.62.180.194:2078
209.182.122.217:443
189.150.107.132:443
72.240.200.181:2222
73.32.115.251:443
72.223.123.155:443
75.90.53.37:443
205.178.7.90:443
187.213.52.174:995
45.32.155.12:443
76.179.54.116:443
71.187.170.235:443
69.167.206.238:50001
207.255.161.8:2078
207.255.161.8:32100
31.5.21.66:443
178.222.113.168:995
86.162.13.18:2222
71.126.139.251:443
100.1.39.62:443
5.13.144.137:995
67.165.206.193:993
50.244.112.10:995
72.204.242.138:465
47.44.217.98:443
72.36.59.46:2222
2.90.87.34:995
213.120.109.73:2222
47.146.32.175:443
176.223.8.159:2222
69.11.247.242:443
75.81.25.223:443
50.232.172.114:443
184.180.157.203:2222
190.30.187.34:443
96.18.240.158:443
37.210.186.213:61201
75.136.26.147:443
96.255.188.58:443
207.255.161.8:993
173.26.189.151:443
70.123.92.175:2222
72.82.15.220:443
108.46.145.30:443
5.15.29.67:443
74.75.237.11:443
68.174.15.223:443
156.213.179.139:443
199.247.22.145:443
188.51.33.232:995
50.244.112.106:443
94.59.227.197:995
47.28.131.209:443
118.167.118.227:443
71.182.142.63:443
141.158.47.123:443
72.204.242.138:990
80.14.209.42:2222
208.93.202.49:443
41.228.24.11:443
72.179.13.59:443
24.187.59.203:2222
24.37.178.158:443
50.104.68.223:443
5.12.0.239:443
173.245.152.231:443
72.214.55.195:995
66.57.216.53:993
189.231.196.236:443
67.209.195.198:443
24.231.54.185:2222
98.240.24.57:443
207.255.161.8:995
86.98.89.62:2222
217.165.164.132:2222
51.223.158.125:443
45.77.193.83:443
207.246.75.201:443
95.179.247.224:443
199.247.16.80:443
73.228.1.246:443
24.229.150.54:995
209.137.209.163:995
45.32.154.10:443
5.193.181.221:2078
41.232.231.135:995
148.101.68.96:443
190.85.91.154:443
144.139.47.206:443
72.190.101.70:443
80.195.103.146:2222
2.91.109.154:995
95.77.144.238:443
47.180.66.10:443
77.27.174.49:995
195.162.106.93:2222
190.220.8.10:443
191.84.7.1:443
5.234.221.88:995
117.218.208.239:443
84.117.176.32:443
73.227.232.166:443
96.30.198.161:443
47.146.169.85:443
46.53.26.66:443
72.204.242.138:20
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exepid process 2972 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe 1516 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe 1516 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.execmd.exedescription pid process target process PID 2972 wrote to memory of 1516 2972 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe PID 2972 wrote to memory of 1516 2972 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe PID 2972 wrote to memory of 1516 2972 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe PID 2972 wrote to memory of 1516 2972 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe PID 2972 wrote to memory of 3056 2972 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe cmd.exe PID 2972 wrote to memory of 3056 2972 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe cmd.exe PID 2972 wrote to memory of 3056 2972 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe cmd.exe PID 2972 wrote to memory of 3056 2972 5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe cmd.exe PID 3056 wrote to memory of 2100 3056 cmd.exe PING.EXE PID 3056 wrote to memory of 2100 3056 cmd.exe PING.EXE PID 3056 wrote to memory of 2100 3056 cmd.exe PING.EXE PID 3056 wrote to memory of 2100 3056 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1516-2-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB
-
memory/1516-3-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB
-
memory/1516-4-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB
-
memory/2972-0-0x0000000001F10000-0x0000000001FF8000-memory.dmpFilesize
928KB
-
memory/2972-1-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/2972-7-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/2972-6-0x0000000001F10000-0x0000000001FF8000-memory.dmpFilesize
928KB
-
memory/2972-5-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB