Analysis

  • max time kernel
    67s
  • max time network
    54s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2024, 16:40

General

  • Target

    01340048af59a7ac31b10934920698b2_JaffaCakes118.exe

  • Size

    2.1MB

  • MD5

    01340048af59a7ac31b10934920698b2

  • SHA1

    8c205adc18cca457bacc57592b91d6e7bcb792e1

  • SHA256

    5890aec86a1f5e8ebd5e54fb2d1137c9a42f49eaa2893fc8f3ac45030e2366f0

  • SHA512

    0be0fcbecbf21e6925d1edd95cabeef1aad0d37ec18ef53b89322bb637ee3fae5d882b93c0c96d9cc9fca9a3c65bf5b81b50948d0abed6744182c668725fcbc8

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWwwN

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01340048af59a7ac31b10934920698b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\01340048af59a7ac31b10934920698b2_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3308
      • C:\Users\Admin\AppData\Local\Temp\01340048af59a7ac31b10934920698b2_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\01340048af59a7ac31b10934920698b2_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:784
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:4692

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\Parameters.ini

              Filesize

              74B

              MD5

              6687785d6a31cdf9a5f80acb3abc459b

              SHA1

              1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

              SHA256

              3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

              SHA512

              5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

            • memory/652-0-0x0000000000890000-0x0000000000891000-memory.dmp

              Filesize

              4KB

            • memory/652-41-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

            • memory/652-43-0x0000000000890000-0x0000000000891000-memory.dmp

              Filesize

              4KB

            • memory/652-47-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

            • memory/784-44-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

            • memory/784-46-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

            • memory/784-51-0x0000000000440000-0x0000000000509000-memory.dmp

              Filesize

              804KB

            • memory/784-53-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB