Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 11:03
Behavioral task
behavioral1
Sample
15c322e957e74d68ba7fb5a06fa8c2da_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
15c322e957e74d68ba7fb5a06fa8c2da_JaffaCakes118.exe
-
Size
8KB
-
MD5
15c322e957e74d68ba7fb5a06fa8c2da
-
SHA1
67ea1c9321ec07c01332c35a982c76380a94b69c
-
SHA256
13bafa194263261f954f57d6a9d29f89f515faf8c30467e0a7287cec25ed665e
-
SHA512
9a9cbe001d04d7c242107eecd8747281afc5b6319fbc14c8294c537257ce77d27db1ac5b080106675ba3e1cdb338dde2af27e743cfe18068cd8f048875c774f7
-
SSDEEP
192:+sJZQFOq5VcchzIUbBFaNJhLkwcud2DH9VwGfctl3O:ZXWOq5+chEK3aNJawcudoD7US
Malware Config
Extracted
gozi
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
b2e.exepid process 2260 b2e.exe -
Loads dropped DLL 2 IoCs
Processes:
15c322e957e74d68ba7fb5a06fa8c2da_JaffaCakes118.exepid process 3024 15c322e957e74d68ba7fb5a06fa8c2da_JaffaCakes118.exe 3024 15c322e957e74d68ba7fb5a06fa8c2da_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/3024-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/3024-13-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
15c322e957e74d68ba7fb5a06fa8c2da_JaffaCakes118.exeb2e.exedescription pid process target process PID 3024 wrote to memory of 2260 3024 15c322e957e74d68ba7fb5a06fa8c2da_JaffaCakes118.exe b2e.exe PID 3024 wrote to memory of 2260 3024 15c322e957e74d68ba7fb5a06fa8c2da_JaffaCakes118.exe b2e.exe PID 3024 wrote to memory of 2260 3024 15c322e957e74d68ba7fb5a06fa8c2da_JaffaCakes118.exe b2e.exe PID 3024 wrote to memory of 2260 3024 15c322e957e74d68ba7fb5a06fa8c2da_JaffaCakes118.exe b2e.exe PID 2260 wrote to memory of 2192 2260 b2e.exe cmd.exe PID 2260 wrote to memory of 2192 2260 b2e.exe cmd.exe PID 2260 wrote to memory of 2192 2260 b2e.exe cmd.exe PID 2260 wrote to memory of 2192 2260 b2e.exe cmd.exe PID 2260 wrote to memory of 332 2260 b2e.exe cmd.exe PID 2260 wrote to memory of 332 2260 b2e.exe cmd.exe PID 2260 wrote to memory of 332 2260 b2e.exe cmd.exe PID 2260 wrote to memory of 332 2260 b2e.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15c322e957e74d68ba7fb5a06fa8c2da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15c322e957e74d68ba7fb5a06fa8c2da_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\61BF.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\61BF.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\61BF.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\15c322e957e74d68ba7fb5a06fa8c2da_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\6374.tmp\batfile.bat" "3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6374.tmp\batfile.batFilesize
94B
MD50fc8c95d090d58b2cb9c2ad0e26132e4
SHA114199fdc66d24d4cb8c07d8df4b341c5ba0130e3
SHA2566c08a607c6ff07db1cbe4f72123e6250a35f0a45f29f586ef558551b4708b2e6
SHA5127b2c88a83dd8b2b13fdf1645fc5f791798414e4c2d457cbe61b0ce63c23143c0c698ef3a7e44d82e8eca282995e0f9c493913e0b4c91220b16ac062847238942
-
C:\Users\Admin\AppData\Local\Temp\selfdel0.batFilesize
158B
MD5728df393046bb2cf991306d1af35c1e3
SHA10f105efe501871e7d430ca2668ab3ab9c14c3225
SHA25693c42cd205a98a1c4176156d1fb01139c363e4b24ff314b7a2ec6550f5a63b3c
SHA5127a3770d564a67836bd7a2d0f26b0a1279edc31215f4849cfb390b16982d3cb92a5bc1cf724c5dd8ef2e52f9ef72d5a5115ec795422db81d881c8bcae6cffba8b
-
\Users\Admin\AppData\Local\Temp\61BF.tmp\b2e.exeFilesize
8KB
MD507c281da32f3b5d09ede7735a50543c4
SHA12c419eba3e2d8a73b8e40ef56d61a08700f2b03b
SHA256edd19019911dab46f1a6925a6246f41ca67a66c48c143e9d53fef797719712fe
SHA512179ecc29cde5f4d7ca363c65981697a7698da27e3b31690f92f2e3bf4d35a493bbc0cde195d9d67517a6fd8dfb7c462397bb81d54823284bf0ee9ac5c85fdd15
-
memory/2260-14-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/2260-73-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/3024-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3024-5-0x0000000002430000-0x0000000002435000-memory.dmpFilesize
20KB
-
memory/3024-9-0x0000000002430000-0x0000000002435000-memory.dmpFilesize
20KB
-
memory/3024-13-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB