Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-04-2024 04:28
Behavioral task
behavioral1
Sample
fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe
-
Size
76KB
-
MD5
fe6f30fbcb892daac0ac242b8416b507
-
SHA1
09bab8f72b6e81e45f62828237632cdc0378738a
-
SHA256
c6622a58d2a35cf780a05222c9c77336fe5017d6e7c4f2f5641b9c3d2271ee5b
-
SHA512
c9db7f5b123ffa17c424caf3047c8fd0db4ab16662cedca8568ab4092ed28d94289d282c24d75959f29a5ea02c6b98fbcb4ca2cfa1d5e4f535e46ce438d75518
-
SSDEEP
1536:0otbWNuh6OI20C4IrCs2C7Oxy5rojOlAh9Y:0QbWf20C4IrccS4oE09Y
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
Processes:
fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\tmipo.bat fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wpcap.dll fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tutility.txt fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe File created C:\Windows\SysWOW64\fat32.sys fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exepid process 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 480 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exedescription pid process Token: SeRestorePrivilege 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.execmd.exenet.exedescription pid process target process PID 1160 wrote to memory of 2008 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe cmd.exe PID 1160 wrote to memory of 2008 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe cmd.exe PID 1160 wrote to memory of 2008 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe cmd.exe PID 1160 wrote to memory of 2008 1160 fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe cmd.exe PID 2008 wrote to memory of 1976 2008 cmd.exe net.exe PID 2008 wrote to memory of 1976 2008 cmd.exe net.exe PID 2008 wrote to memory of 1976 2008 cmd.exe net.exe PID 2008 wrote to memory of 1976 2008 cmd.exe net.exe PID 1976 wrote to memory of 2132 1976 net.exe net1.exe PID 1976 wrote to memory of 2132 1976 net.exe net1.exe PID 1976 wrote to memory of 2132 1976 net.exe net1.exe PID 1976 wrote to memory of 2132 1976 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe6f30fbcb892daac0ac242b8416b507_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\tmipo.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop sharedaccess3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\tmipo.batFilesize
21B
MD57b16cc4ebd5af5d255eeb8a7b487875b
SHA13f679d76efb21f7b2249ddc2a0d8a68d71220d16
SHA2565040cfcc7def4d52830218981dc6cb729abe9eb3b1a38d8df5c56698336098b1
SHA5127f16419eddc8cedb0e133fe482a958cf6997b8b30456a3f3949066e9279fef888e1297065850f77bdae189a5d93e6bc69eb6e33d73ef1e0d64642f2fb2ff61d0