Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 05:08
Static task
static1
Behavioral task
behavioral1
Sample
fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe
-
Size
1000KB
-
MD5
fbfeffc8bb179aa5fc25ebb6aa325e09
-
SHA1
1e0f603ad7633bad06c30e47ee0e28ecd133dd2c
-
SHA256
9afc51e8f87eeba8a2e9f79dad1760439920bca34b7c350e393e20b0c5f2ea44
-
SHA512
7a26eafbdf572b6860a34c51846a23aec762bf2645a68d8c8e2594aef4078d6f76f7f72ed281424f8a31b053577066c3cbbde94fc89c6c1f09dc5c5e8e56d0a8
-
SSDEEP
24576:4Pnw0s36lSY1yuYqSNh4kuD8W1B+5vMiqt0gj2ed:4Pds36Qy5KVugUqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4404 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4404 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 19 pastebin.com 24 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4404 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3004 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4404 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe 4404 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3192 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3192 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe 4404 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3192 wrote to memory of 4404 3192 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe 85 PID 3192 wrote to memory of 4404 3192 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe 85 PID 3192 wrote to memory of 4404 3192 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe 85 PID 4404 wrote to memory of 3004 4404 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe 89 PID 4404 wrote to memory of 3004 4404 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe 89 PID 4404 wrote to memory of 3004 4404 fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\fbfeffc8bb179aa5fc25ebb6aa325e09_JaffaCakes118.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:3004
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1000KB
MD5fca953bfffa8f416ca4045ac48b8f607
SHA196f452d89ed6a42a13b5c173e88908206f32a297
SHA256aca49279683885c24b26553652a3c632a6c5e255ae164c3dcd6a301870acbb5d
SHA51263b489496985a0945e17e89edad79089c5ccec8b3bbd0254d51dc8c4f0b9fd47ee48551837fa3420481eea8b14358da1b92e6858b9441a442be545c27616c199