Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 08:32
Behavioral task
behavioral1
Sample
1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe
-
Size
96KB
-
MD5
1a9d40f979c2e89ff475b9442dd032a0
-
SHA1
cb2a3beadaa24b416bdec3e0772fa5d0f1885df3
-
SHA256
405dd042df3a215bef62d7d6c7f7a6fc1a215d882c64380f87a3ba436de24e62
-
SHA512
59612d4a31382f13cb72e326a9c692fa04fb445ce223172578f5eab077c2412366a8a62ef7f4fd3643f2999131c422beacca0a6700c82870b14ca9d9eb13f118
-
SSDEEP
1536:+nRDdoT5ByBtnGxYbee2lAVJkEtQwoAzkIvc0rqVq5GnE9unGg1cQ7IoqAqLWQu0:yc5kBtGxJneJERAw9E9cFmQ7INA4t/I0
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2528 cmd.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 2520 rundll32.exe 2520 rundll32.exe 2520 rundll32.exe 2520 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2276-0-0x0000000000400000-0x0000000000441000-memory.dmp vmprotect behavioral1/memory/2276-1-0x0000000000400000-0x0000000000441000-memory.dmp vmprotect behavioral1/memory/2276-20-0x0000000000400000-0x0000000000441000-memory.dmp vmprotect -
Drops file in System32 directory 1 IoCs
Processes:
1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Darkbomb.dll 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.execmd.exedescription pid process target process PID 2276 wrote to memory of 1664 2276 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe PID 2276 wrote to memory of 1664 2276 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe PID 2276 wrote to memory of 1664 2276 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe PID 2276 wrote to memory of 1664 2276 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe PID 1664 wrote to memory of 2520 1664 cmd.exe rundll32.exe PID 1664 wrote to memory of 2520 1664 cmd.exe rundll32.exe PID 1664 wrote to memory of 2520 1664 cmd.exe rundll32.exe PID 1664 wrote to memory of 2520 1664 cmd.exe rundll32.exe PID 1664 wrote to memory of 2520 1664 cmd.exe rundll32.exe PID 1664 wrote to memory of 2520 1664 cmd.exe rundll32.exe PID 1664 wrote to memory of 2520 1664 cmd.exe rundll32.exe PID 2276 wrote to memory of 2528 2276 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe PID 2276 wrote to memory of 2528 2276 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe PID 2276 wrote to memory of 2528 2276 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe PID 2276 wrote to memory of 2528 2276 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "c:\support338945a0.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe Darkbomb.dll FunctionStart3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1A9D40~1.EXE >> NUL2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Darkbomb.dllFilesize
42KB
MD5cd7c4b4ea5da926d4b166b5a577c6b87
SHA178a18a4d1e628957221bbba7dc6a129cbffee719
SHA256f2b482023389f42578000a3bbefaa7df0e0dae11df82ab142a111c9ba556fa40
SHA5122ffd9ce2b1819c620bd90da87497b509114bbf8833d741ea609c4515144d2408282fd57807443b4ab47562c9721426ea3826a4e3991a182ee0777f4042433321
-
C:\support338945a0.batFilesize
39B
MD5d6ad254c75599ac9ceb317d261cfe354
SHA1f9c9bae9bdba0ea9d3c486e13cb554ec9b010909
SHA2563142a7859b079df4a8fd3daf7a9d0057dd2c18ca302c69a6f9526ee543c9a655
SHA512b05820cab51f66b5b8213359f0a0ddde125e3eab5fdfd196393dc805fc02fd9e72bdb1704cc0718131fc55a8b3d7cd7e54f53fa8140a187b508c443f6d85b473
-
memory/2276-0-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2276-1-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2276-20-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2520-19-0x000000001000E000-0x000000001000F000-memory.dmpFilesize
4KB
-
memory/2520-18-0x0000000010000000-0x0000000010012000-memory.dmpFilesize
72KB
-
memory/2520-21-0x0000000010000000-0x0000000010012000-memory.dmpFilesize
72KB