Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 02:14
Behavioral task
behavioral1
Sample
fbb3d53cea267825bb97cf462c025ba5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fbb3d53cea267825bb97cf462c025ba5_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fbb3d53cea267825bb97cf462c025ba5_JaffaCakes118.exe
-
Size
2.7MB
-
MD5
fbb3d53cea267825bb97cf462c025ba5
-
SHA1
67adaefd0658b75a83b69d4b229f76091a3e58c6
-
SHA256
8a418295b6ec424c52cde190e2825ed71245aa86f92d73a9206898ca5e725050
-
SHA512
3694d02e0aaf8e8479013ab5e50e3337050513fe6d7a4fedc83df0960a651925e2a1d159eac7fe15ca6609f7da93efcc89336dbd3b5d643a20b6adee5b68e477
-
SSDEEP
49152:/L4HmS8ckUgzgU1cTbs0I1DpIYBzgjnXODhG8GWmDXNSQTMKCkKc6cdaxsRO+Az4:kGS8cVgzgmcU0I1Dp/dqnXbWmDXNTTMc
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/460-0-0x0000000000400000-0x0000000000F89000-memory.dmp upx behavioral2/memory/460-2-0x0000000000400000-0x0000000000F89000-memory.dmp upx behavioral2/memory/460-5-0x0000000000400000-0x0000000000F89000-memory.dmp upx behavioral2/memory/460-6-0x0000000000400000-0x0000000000F89000-memory.dmp upx behavioral2/memory/460-7-0x0000000000400000-0x0000000000F89000-memory.dmp upx behavioral2/memory/460-8-0x0000000000400000-0x0000000000F89000-memory.dmp upx behavioral2/memory/460-10-0x0000000000400000-0x0000000000F89000-memory.dmp upx behavioral2/memory/460-11-0x0000000000400000-0x0000000000F89000-memory.dmp upx behavioral2/memory/460-12-0x0000000000400000-0x0000000000F89000-memory.dmp upx behavioral2/memory/460-14-0x0000000000400000-0x0000000000F89000-memory.dmp upx behavioral2/memory/460-16-0x0000000000400000-0x0000000000F89000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fbb3d53cea267825bb97cf462c025ba5_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Arquivos de programas\\WindowsUpdate.scr" fbb3d53cea267825bb97cf462c025ba5_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
fbb3d53cea267825bb97cf462c025ba5_JaffaCakes118.exepid process 460 fbb3d53cea267825bb97cf462c025ba5_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/460-0-0x0000000000400000-0x0000000000F89000-memory.dmpFilesize
11.5MB
-
memory/460-1-0x0000000002E50000-0x0000000002E51000-memory.dmpFilesize
4KB
-
memory/460-2-0x0000000000400000-0x0000000000F89000-memory.dmpFilesize
11.5MB
-
memory/460-4-0x0000000002E50000-0x0000000002E51000-memory.dmpFilesize
4KB
-
memory/460-5-0x0000000000400000-0x0000000000F89000-memory.dmpFilesize
11.5MB
-
memory/460-6-0x0000000000400000-0x0000000000F89000-memory.dmpFilesize
11.5MB
-
memory/460-7-0x0000000000400000-0x0000000000F89000-memory.dmpFilesize
11.5MB
-
memory/460-8-0x0000000000400000-0x0000000000F89000-memory.dmpFilesize
11.5MB
-
memory/460-10-0x0000000000400000-0x0000000000F89000-memory.dmpFilesize
11.5MB
-
memory/460-11-0x0000000000400000-0x0000000000F89000-memory.dmpFilesize
11.5MB
-
memory/460-12-0x0000000000400000-0x0000000000F89000-memory.dmpFilesize
11.5MB
-
memory/460-14-0x0000000000400000-0x0000000000F89000-memory.dmpFilesize
11.5MB
-
memory/460-16-0x0000000000400000-0x0000000000F89000-memory.dmpFilesize
11.5MB