Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 04:44
Static task
static1
Behavioral task
behavioral1
Sample
046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
046658187511d7d37e6f1712af2e0529
-
SHA1
ee32fb23dd8a943bf27339107226138e0e3fe24c
-
SHA256
3ccec50b80a73e3ec567c30ed4768ead79fa6f2b037913da351d7acd523a2828
-
SHA512
6804daf5e125cd42b690315df3c7f32b7f8b4ea5a3deb5b8ba6c9e839974d8733121fbd976ed78d856cd213c8760eb859a0a9f7d904a6be3ad27c9a21e93c9d8
-
SSDEEP
49152:hcMA7xU81kHR6gWakurxp937WHI1xtTqgKXca:hcW7Wo1SgQca
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
Processes:
046658187511d7d37e6f1712af2e0529_JaffaCakes118.exepid process 1628 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 1628 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 1628 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 1628 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe -
Processes:
046658187511d7d37e6f1712af2e0529_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe046658187511d7d37e6f1712af2e0529_JaffaCakes118.exedescription pid process target process PID 2068 wrote to memory of 2084 2068 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe PID 2068 wrote to memory of 2084 2068 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe PID 2068 wrote to memory of 2084 2068 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe PID 2068 wrote to memory of 2084 2068 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe PID 2068 wrote to memory of 2084 2068 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe PID 2068 wrote to memory of 2084 2068 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe PID 2068 wrote to memory of 2084 2068 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe PID 2084 wrote to memory of 1628 2084 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe PID 2084 wrote to memory of 1628 2084 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe PID 2084 wrote to memory of 1628 2084 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe PID 2084 wrote to memory of 1628 2084 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe PID 2084 wrote to memory of 1628 2084 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe PID 2084 wrote to memory of 1628 2084 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe PID 2084 wrote to memory of 1628 2084 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe"3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\pISFI0vvnfpJw5CWVe7\1CykprGzL.dllFilesize
74KB
MD5727216a3430f46b6e4a154784e32cf7f
SHA1a4424006237bd64bb57ae5867b77883c216e43a2
SHA256b00fb2d7e9a786ecb46b57ddc8c216135ac296c80844f4a97577d532f7a05a05
SHA512bc7a3498a3410e10f0d0a6a79b9958cd2e814426dd29ebc9735aa9ac0a0d93102f8d4c84a53314b442065185fd15393373be1f6e689e37fea0e7526fda383608
-
\Users\Admin\AppData\Local\Temp\pISFI0vvnfpJw5CWVe7\2aDOHAaW7P.dllFilesize
200KB
MD5f81289b5936bebef64a0d143262f6028
SHA1cf472fd32ec4e9cc0a5f7c70c762764d1d88875a
SHA256e0d5b71faae38634922fcb488bcc2778c67f7169c02e974c2e6681f27a5c2338
SHA51282975edee7ce51b662ec6120c647aa4f0998e58ca6a1bf0ede0457e0d5d60023c12a668d8704a1044af3bf30b97d3ae8c1563855fa67de8e18a8ef354e61d355
-
\Users\Admin\AppData\Local\Temp\pISFI0vvnfpJw5CWVe7\lua51.dllFilesize
494KB
MD5f0c59526f8186eadaf2171b8fd2967c1
SHA18ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA2566e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854
-
\Users\Admin\AppData\Local\Temp\pISFI0vvnfpJw5CWVe7\yZvWSsXxcDUukLwXNnrSdEbC90vWFf90iJ.dllFilesize
5KB
MD544dac7f87bdf94d553f8d2cf073d605d
SHA121bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA2560e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA51292c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774
-
memory/1628-16-0x000000007EFA0000-0x000000007EFB0000-memory.dmpFilesize
64KB
-
memory/1628-13-0x00000000005F0000-0x0000000000626000-memory.dmpFilesize
216KB
-
memory/1628-19-0x000000007EFA0000-0x000000007EFB0000-memory.dmpFilesize
64KB
-
memory/1628-20-0x000000007EFA0000-0x000000007EFB0000-memory.dmpFilesize
64KB
-
memory/1628-18-0x000000007EFA0000-0x000000007EFB0000-memory.dmpFilesize
64KB
-
memory/1628-17-0x000000007EFA0000-0x000000007EFB0000-memory.dmpFilesize
64KB
-
memory/1628-21-0x000000007EF90000-0x000000007EFA0000-memory.dmpFilesize
64KB
-
memory/1628-8-0x0000000000250000-0x0000000000267000-memory.dmpFilesize
92KB
-
memory/2068-0-0x0000000000400000-0x00000000005EE000-memory.dmpFilesize
1.9MB