Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 22:28
Behavioral task
behavioral1
Sample
11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe
-
Size
285KB
-
MD5
11b081b43a1b69c12d860c5494826b27
-
SHA1
0019b7b9ca7a59039a55bdbcc3dc4f5271879381
-
SHA256
58cf776d245ef1cb53c44a2cf6d24adb2c814568ff15a3f9038edb2be01bdc27
-
SHA512
55e6542aeab106441b7756bf502eb0246cdec96023fc55e30ce7432ea783be753c0bec92bafaf5d9587c37a3168e3cf3d0626eb4f5a7e852f0c4b9b0e5e75db5
-
SSDEEP
6144:x1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe/ZVMXTw:xjkArEN249AyE/rbaMct4bO2/n
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2728 tcpscrex.exe -
Loads dropped DLL 4 IoCs
pid Process 2004 11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe 2004 11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe 2004 11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe 2004 11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2004-0-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2004-1-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/files/0x0030000000014baa-8.dat upx behavioral1/memory/2004-20-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2728-23-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2728-25-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2728-26-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2728-27-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2728-28-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2728-29-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2728-30-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2728-31-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2728-32-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2728-33-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2728-34-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2728-35-0x0000000000400000-0x00000000004B4000-memory.dmp upx -
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2004-1-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2004-20-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2728-23-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2728-25-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2728-26-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2728-27-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2728-28-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2728-29-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2728-30-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2728-31-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2728-32-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2728-33-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2728-34-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2728-35-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Managemenot\Monitor\tcpscrex.exe 11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe File opened for modification C:\Program Files\Managemenot\Monitor\tcpscrex.exe 11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe File created C:\Program Files (x86)\Activxr\Rescuer.exe tcpscrex.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe 2728 tcpscrex.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2728 2004 11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe 29 PID 2004 wrote to memory of 2728 2004 11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe 29 PID 2004 wrote to memory of 2728 2004 11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe 29 PID 2004 wrote to memory of 2728 2004 11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11b081b43a1b69c12d860c5494826b27_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Program Files\Managemenot\Monitor\tcpscrex.exe"C:\Program Files\Managemenot\Monitor\tcpscrex.exe" 0.0.0.02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
285KB
MD51be87aaab650e1205ed90c2c6e60a201
SHA160dce96a9c49813c50962877824268385b04ae2a
SHA256ca43ce0c6eac92d69e267131dd0a0db3ac74f364e7b70134278710ee2efdd350
SHA5121245e5c2087d84728dd06e38db2bf1743919c63e70ae48b46444cc13ebdfa432ee1b7e668ea46ddf8eb57dfca82c088317f0bfc681f5ab8260996db62ef80854