Analysis
-
max time kernel
11s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 04:33
Static task
static1
Behavioral task
behavioral1
Sample
0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe
-
Size
649KB
-
MD5
0462226fc355fb6c9b0a3c7ba0f0810a
-
SHA1
ef571b01aa677063321a417e248f7af754b13f48
-
SHA256
124d8223377941420b9dd05fd9006b900b501c86908da2b665a15d088375f1bc
-
SHA512
9ca3269248616e86bbe215258d53ab6b21ae70e220dd1f1e0f6b8b2b31db568d0a887a9f27d042d8da32ef86e558ac65cb747ab3ccfaa07c10fe6589dcfabe15
-
SSDEEP
12288:L0isZsn8vFAJmLPaJfl+Ed7dt4AHNQURii03iKuimWM3FEPl:L0JZhF6zJfF70mOUZSut6l
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1956-4-0x00000000022C0000-0x0000000002401000-memory.dmp upx behavioral2/memory/1956-1-0x00000000022C0000-0x0000000002401000-memory.dmp upx behavioral2/memory/1956-7-0x00000000022C0000-0x0000000002401000-memory.dmp upx behavioral2/memory/1956-6-0x00000000022C0000-0x0000000002401000-memory.dmp upx behavioral2/memory/1956-5-0x00000000022C0000-0x0000000002401000-memory.dmp upx behavioral2/memory/1956-93-0x00000000022C0000-0x0000000002401000-memory.dmp upx behavioral2/memory/1956-94-0x00000000022C0000-0x0000000002401000-memory.dmp upx behavioral2/memory/1956-96-0x00000000022C0000-0x0000000002401000-memory.dmp upx behavioral2/memory/1956-95-0x00000000022C0000-0x0000000002401000-memory.dmp upx behavioral2/memory/1956-97-0x00000000022C0000-0x0000000002401000-memory.dmp upx behavioral2/memory/1112-111-0x0000000002170000-0x00000000022B1000-memory.dmp upx behavioral2/memory/1112-112-0x0000000002170000-0x00000000022B1000-memory.dmp upx behavioral2/memory/1112-105-0x0000000002170000-0x00000000022B1000-memory.dmp upx behavioral2/memory/1112-108-0x0000000002170000-0x00000000022B1000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exepid process 1956 0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe 1956 0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exedescription pid process target process PID 1956 wrote to memory of 1112 1956 0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe 0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe PID 1956 wrote to memory of 1112 1956 0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe 0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe PID 1956 wrote to memory of 1112 1956 0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe 0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0462226fc355fb6c9b0a3c7ba0f0810a_JaffaCakes118.exe" /_ShowProgress2⤵PID:1112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ISH240~1\images\Close_Hover.pngFilesize
1KB
MD583487401daf307d6c726a479de1ee6f9
SHA1c173be4937a63672570078b325864c76b28040b8
SHA256f4f0f59fccd9b87b208b416423797dcfb532472dcfef99bef41a11ea9f6f713b
SHA512da69729b6682acd1c46587c7c3b4533d9afbcf84c17e55f43798f1fee0097c7a2f39860e6dbc6a9b1cb26dc63d9afab4511071981ad5fd494f36ad9659c56e50
-
C:\Users\Admin\AppData\Local\Temp\ish240641890\bootstrap_23437.htmlFilesize
156B
MD51ea9e5b417811379e874ad4870d5c51a
SHA1a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa
-
memory/1112-113-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/1112-108-0x0000000002170000-0x00000000022B1000-memory.dmpFilesize
1.3MB
-
memory/1112-105-0x0000000002170000-0x00000000022B1000-memory.dmpFilesize
1.3MB
-
memory/1112-110-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1112-112-0x0000000002170000-0x00000000022B1000-memory.dmpFilesize
1.3MB
-
memory/1112-111-0x0000000002170000-0x00000000022B1000-memory.dmpFilesize
1.3MB
-
memory/1956-5-0x00000000022C0000-0x0000000002401000-memory.dmpFilesize
1.3MB
-
memory/1956-94-0x00000000022C0000-0x0000000002401000-memory.dmpFilesize
1.3MB
-
memory/1956-96-0x00000000022C0000-0x0000000002401000-memory.dmpFilesize
1.3MB
-
memory/1956-95-0x00000000022C0000-0x0000000002401000-memory.dmpFilesize
1.3MB
-
memory/1956-97-0x00000000022C0000-0x0000000002401000-memory.dmpFilesize
1.3MB
-
memory/1956-93-0x00000000022C0000-0x0000000002401000-memory.dmpFilesize
1.3MB
-
memory/1956-8-0x0000000000580000-0x0000000000581000-memory.dmpFilesize
4KB
-
memory/1956-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1956-6-0x00000000022C0000-0x0000000002401000-memory.dmpFilesize
1.3MB
-
memory/1956-7-0x00000000022C0000-0x0000000002401000-memory.dmpFilesize
1.3MB
-
memory/1956-1-0x00000000022C0000-0x0000000002401000-memory.dmpFilesize
1.3MB
-
memory/1956-4-0x00000000022C0000-0x0000000002401000-memory.dmpFilesize
1.3MB