Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 20:26
Static task
static1
Behavioral task
behavioral1
Sample
f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe
-
Size
707KB
-
MD5
f1da97ff8e456b9a852f87ad01f90436
-
SHA1
4d3112dbc7374fe4862898bbefe25b8ea9b93446
-
SHA256
1c146e80516e1e79ca4f8785b2ce93211e44f269c4c692a8b756bb7634c2a2b5
-
SHA512
d02d3103eecd3308bcfa88652916a525cf54025a04ce872370cd437956ae1c6921ea17c24eb0f30e7b68aae77601e76bbe357354bcd3616de463ed5ce4425007
-
SSDEEP
12288:SlxNv/A8haLlsEHG+2C9mIzUewRTCe22n0Kz1AmsUA+xENlQuHpm24W5MNmE5qAo:t7HGpC9mIzUewRTCe22n0KzOmsUelQky
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2676 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2676 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exedescription pid process target process PID 2972 wrote to memory of 2676 2972 f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe powershell.exe PID 2972 wrote to memory of 2676 2972 f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe powershell.exe PID 2972 wrote to memory of 2676 2972 f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe powershell.exe PID 2972 wrote to memory of 2676 2972 f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe powershell.exe PID 2972 wrote to memory of 2428 2972 f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe PID 2972 wrote to memory of 2428 2972 f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe PID 2972 wrote to memory of 2428 2972 f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe PID 2972 wrote to memory of 2428 2972 f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe PID 2972 wrote to memory of 2428 2972 f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe PID 2972 wrote to memory of 2428 2972 f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe PID 2972 wrote to memory of 2428 2972 f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f1da97ff8e456b9a852f87ad01f90436_JaffaCakes118.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2428-5-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2428-11-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2428-9-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2428-7-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2676-15-0x00000000748E0000-0x0000000074E8B000-memory.dmpFilesize
5.7MB
-
memory/2676-16-0x00000000748E0000-0x0000000074E8B000-memory.dmpFilesize
5.7MB
-
memory/2676-17-0x0000000002970000-0x00000000029B0000-memory.dmpFilesize
256KB
-
memory/2676-18-0x00000000748E0000-0x0000000074E8B000-memory.dmpFilesize
5.7MB
-
memory/2972-4-0x0000000002080000-0x00000000020C0000-memory.dmpFilesize
256KB
-
memory/2972-3-0x00000000748E0000-0x0000000074E8B000-memory.dmpFilesize
5.7MB
-
memory/2972-2-0x0000000002080000-0x00000000020C0000-memory.dmpFilesize
256KB
-
memory/2972-1-0x00000000748E0000-0x0000000074E8B000-memory.dmpFilesize
5.7MB
-
memory/2972-0-0x00000000748E0000-0x0000000074E8B000-memory.dmpFilesize
5.7MB