Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 19:45
Static task
static1
Behavioral task
behavioral1
Sample
ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe
-
Size
2.8MB
-
MD5
ebd9d85830b4dece8604ee4ccd72d1ab
-
SHA1
57c97b99fec3c8e3b96af38742ac0dd9494f6ae5
-
SHA256
059440fbc87f60e75424846b3843b984e860e27accd2b14c01727e259ce38d48
-
SHA512
f55397575f224ae7aaab206d85f022572f99c62b11a416c25972a53396f42a67c27949d65c70e7c5db4eda0309f6ce2f731235d4c9aa913078128cd9594e3bee
-
SSDEEP
49152:WPpKRy6jLXEi535czox51ekDRMYxcC/ofhU83y2Rep685MQvUH6d:UKRJjT3535cS1eY3EJJ3y2C6cWk
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exepid process 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exedescription pid process target process PID 1248 wrote to memory of 2452 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe schtasks.exe PID 1248 wrote to memory of 2452 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe schtasks.exe PID 1248 wrote to memory of 2452 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe schtasks.exe PID 1248 wrote to memory of 2452 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe schtasks.exe PID 1248 wrote to memory of 2444 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2444 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2444 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2444 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2464 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2464 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2464 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2464 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 1728 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 1728 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 1728 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 1728 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2892 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2892 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2892 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2892 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2888 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2888 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2888 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe PID 1248 wrote to memory of 2888 1248 ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UuazQipl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFC97.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ebd9d85830b4dece8604ee4ccd72d1ab_JaffaCakes118.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpFC97.tmpFilesize
1KB
MD552a5ddda4e84081f7e0ed42c598f4d51
SHA16641510f9d0b82917790f2a2b18f169bf7af3f18
SHA2562ef81b91e0ced6f65c0e570e2d9b1a3c29b7bd7587c47b151719a78a4be869d2
SHA512113f5f5264dd623a9aab7db2e6b408c93c9ea4324e27e04b5cc8e5934171cab3864332b18be85f666faaffb283cab9eba709198d4175b9970d6c907329fce773
-
memory/1248-0-0x0000000000040000-0x000000000030C000-memory.dmpFilesize
2.8MB
-
memory/1248-1-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/1248-2-0x0000000004570000-0x00000000045B0000-memory.dmpFilesize
256KB
-
memory/1248-3-0x0000000000640000-0x0000000000656000-memory.dmpFilesize
88KB
-
memory/1248-4-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/1248-5-0x00000000086A0000-0x0000000008922000-memory.dmpFilesize
2.5MB
-
memory/1248-6-0x000000000BF70000-0x000000000C33A000-memory.dmpFilesize
3.8MB
-
memory/1248-12-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB