Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 15:48
Static task
static1
Behavioral task
behavioral1
Sample
e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe
-
Size
28KB
-
MD5
e7d32dbff7233c5c71748746f3406ba2
-
SHA1
edaca745b398e8c26237b5627508f114e60dd580
-
SHA256
09fc3f2b861160efb76043f3e16b09650afded6dbe56bc4dc1cb299284bf2a9f
-
SHA512
decc24fdc83ca0da35f4991136dd47802229163d4b861308b3ef5d4a5b831a76dc1556696095202a7691b2a2f2ffd40d4be7679b3dbd1e95241be3f994086b7c
-
SSDEEP
384:SDvs1AxlVnvnm6/6evXRMBZ8q6OQgvrOvYl9XVzBPCLB0rLH4CQxUwfSnKf3X1u8:yXAZ8krnISf1otckIiLW1/PEFGUwxTA
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\29433 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\msxssjg.bat" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 4820 svchost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\PROGRA~3\LOCALS~1\Temp\msxssjg.bat svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exepid process 208 e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe 208 e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exedescription pid process target process PID 208 wrote to memory of 4820 208 e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe svchost.exe PID 208 wrote to memory of 4820 208 e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe svchost.exe PID 208 wrote to memory of 4820 208 e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe2⤵
- Adds policy Run key to start application
- Deletes itself
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/208-1-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/208-2-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/208-0-0x00000000001D0000-0x00000000001D5000-memory.dmpFilesize
20KB
-
memory/4820-4-0x00000000001A0000-0x00000000001AE000-memory.dmpFilesize
56KB
-
memory/4820-6-0x00000000001A0000-0x00000000001AE000-memory.dmpFilesize
56KB
-
memory/4820-7-0x0000000000C20000-0x0000000000C27000-memory.dmpFilesize
28KB
-
memory/4820-8-0x0000000000DF0000-0x0000000000DF5000-memory.dmpFilesize
20KB
-
memory/4820-10-0x0000000000DF0000-0x0000000000DF5000-memory.dmpFilesize
20KB