Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 00:55
Static task
static1
Behavioral task
behavioral1
Sample
1467b6a392e31fdf968a1d500089acfb_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1467b6a392e31fdf968a1d500089acfb_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/mxnklldcac.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/mxnklldcac.dll
Resource
win10v2004-20240226-en
General
-
Target
1467b6a392e31fdf968a1d500089acfb_JaffaCakes118.exe
-
Size
276KB
-
MD5
1467b6a392e31fdf968a1d500089acfb
-
SHA1
85375bf2ab5d47386d7870cddd332e152ee8a28f
-
SHA256
4a07b3b4c08db64e0aa91b63b89bdf438814a5236de328efcb11fd9a78ed19bd
-
SHA512
5984eee018336725f99ae84a25016f2776f10c8619781083103c6d89f942589367f38ca558eb5fe88d7fe3bd4af93856b1e81ced8ef395ba6b44eb6cc5ac76c7
-
SSDEEP
6144:wBlL/crbY8dTdivb5Ii36QyNp1RRQRtVtqnWUYtTJd5o2EtNJ:Ce9TAmIf8WRtTb5oB
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 232 1467b6a392e31fdf968a1d500089acfb_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4800 232 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 232 wrote to memory of 4728 232 1467b6a392e31fdf968a1d500089acfb_JaffaCakes118.exe 87 PID 232 wrote to memory of 4728 232 1467b6a392e31fdf968a1d500089acfb_JaffaCakes118.exe 87 PID 232 wrote to memory of 4728 232 1467b6a392e31fdf968a1d500089acfb_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\1467b6a392e31fdf968a1d500089acfb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1467b6a392e31fdf968a1d500089acfb_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\1467b6a392e31fdf968a1d500089acfb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1467b6a392e31fdf968a1d500089acfb_JaffaCakes118.exe"2⤵PID:4728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 9802⤵
- Program crash
PID:4800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 232 -ip 2321⤵PID:4720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5e8821f4a219ccb45aed1c7612459085d
SHA15c484233d7cf59acc5298a23780afc0af780858e
SHA25652e8f0963d2e0439aaf8d3ab16a984403c98d08b96c9a83ad44eee60b8596c7d
SHA5124a3c87bd7cb72185b7cab1b2867b67cb873feb8a3c124cee809df4b373f50c6588c3422563b43abc0341138e2191a192845b3831f70b92bc57d1b2a8cc0087ac