Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11-04-2024 10:31

General

  • Target

    ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    ed365bcdc3a62967573dd36e8232c67d

  • SHA1

    d388df12dae237a1b943ce705f2f9a6c2c227237

  • SHA256

    db6861207c1cbd2f457e51774647b01c6f291773da5cb1a365b0c687ef9dad81

  • SHA512

    c73a79e0091c716a82f777d6570723352df983f4f88de55c3c5f68e05c4e566f277c4114c91d2be22633e009919513ebd0451257c71389a0f27dc43399d6d5da

  • SSDEEP

    24576:CShy76DOlfx8Dgyfx8Dg6J+wRYGrxtvuOEB8JU9feM/wDZuGL:ty76058Dgy58Dg6J+WYobPez9fUZv

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2952
    • C:\Users\Admin\AppData\Local\Temp\ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe"
      2⤵
        PID:2484
      • C:\Users\Admin\AppData\Local\Temp\ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe"
        2⤵
          PID:2428
        • C:\Users\Admin\AppData\Local\Temp\ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe"
          2⤵
            PID:2544
          • C:\Users\Admin\AppData\Local\Temp\ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe"
            2⤵
              PID:2376
            • C:\Users\Admin\AppData\Local\Temp\ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\ed365bcdc3a62967573dd36e8232c67d_JaffaCakes118.exe"
              2⤵
                PID:2388

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2100-1-0x0000000074A20000-0x000000007510E000-memory.dmp
              Filesize

              6.9MB

            • memory/2100-0-0x00000000002C0000-0x0000000000416000-memory.dmp
              Filesize

              1.3MB

            • memory/2100-2-0x0000000004D10000-0x0000000004D50000-memory.dmp
              Filesize

              256KB

            • memory/2100-3-0x0000000000420000-0x0000000000432000-memory.dmp
              Filesize

              72KB

            • memory/2100-4-0x0000000074A20000-0x000000007510E000-memory.dmp
              Filesize

              6.9MB

            • memory/2100-5-0x0000000004D10000-0x0000000004D50000-memory.dmp
              Filesize

              256KB

            • memory/2100-6-0x0000000008460000-0x000000000850A000-memory.dmp
              Filesize

              680KB

            • memory/2100-7-0x0000000002050000-0x0000000002088000-memory.dmp
              Filesize

              224KB

            • memory/2100-8-0x0000000074A20000-0x000000007510E000-memory.dmp
              Filesize

              6.9MB

            • memory/2952-12-0x0000000002A50000-0x0000000002A90000-memory.dmp
              Filesize

              256KB

            • memory/2952-11-0x00000000738F0000-0x0000000073E9B000-memory.dmp
              Filesize

              5.7MB

            • memory/2952-13-0x0000000002A50000-0x0000000002A90000-memory.dmp
              Filesize

              256KB

            • memory/2952-14-0x00000000738F0000-0x0000000073E9B000-memory.dmp
              Filesize

              5.7MB

            • memory/2952-15-0x00000000738F0000-0x0000000073E9B000-memory.dmp
              Filesize

              5.7MB