Analysis
-
max time kernel
66s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 08:06
Static task
static1
Behavioral task
behavioral1
Sample
04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe
-
Size
875KB
-
MD5
04bd92d3a4b4d378dfbdca5a5afe53d1
-
SHA1
b796e17a7995dd3a147fa928a6d337ebcb4efc7a
-
SHA256
222ac0ea40ae8cc119348a609aa3e0b2c431c91d17625e6eea05e86647e733f1
-
SHA512
9ca984d12327ad622861f295dd82da522e1015ac14751fb6d78ced115451fb494cf5b38845371ada20da93290863633586399e424d8622a077d941e52adf9c0e
-
SSDEEP
24576:4HZMLKmtvPyHu7A8vrnBy9pNg4W7HM8tcN+2QHCWa:yZiKmHyOsoTVp7s8UQa
Malware Config
Signatures
-
Loads dropped DLL 6 IoCs
Processes:
04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exepid process 1172 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe 1172 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe 1172 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe 1172 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe 1172 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe 1172 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe -
Processes:
04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exedescription pid process target process PID 3416 wrote to memory of 4820 3416 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe PID 3416 wrote to memory of 4820 3416 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe PID 3416 wrote to memory of 4820 3416 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe PID 4820 wrote to memory of 1172 4820 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe PID 4820 wrote to memory of 1172 4820 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe PID 4820 wrote to memory of 1172 4820 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe 04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04bd92d3a4b4d378dfbdca5a5afe53d1_JaffaCakes118.exe"3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ed9oEXCKgJ0g9IfLVDJ\extramod.dllFilesize
73KB
MD5e460f221b287b2a4101f15ba37c05927
SHA16a9cea4481935851f78e103d84aba246f2bbce81
SHA2566e21c6b303baa4565b33fd27729ebc46821ca77b34b7dd589f8fcca9b1feecd8
SHA512e3d9a77ce2075d36f3692a5bfd5411929ec84041f766b907a84ceab82ebe4ade66f4ea0457da53d1530e3390d6835fbe5d36a7026d6fc25e4014541e52a2baf7
-
C:\Users\Admin\AppData\Local\Temp\ed9oEXCKgJ0g9IfLVDJ\loading_screen.dllFilesize
5KB
MD544dac7f87bdf94d553f8d2cf073d605d
SHA121bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA2560e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA51292c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774
-
C:\Users\Admin\AppData\Local\Temp\ed9oEXCKgJ0g9IfLVDJ\lua51.dllFilesize
494KB
MD5f0c59526f8186eadaf2171b8fd2967c1
SHA18ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA2566e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854
-
C:\Users\Admin\AppData\Local\Temp\ed9oEXCKgJ0g9IfLVDJ\shared_library.dllFilesize
200KB
MD55fbd6a624d51a5571a115d412b155589
SHA12579d4a20ce0b1e2b7b163dd0cc771f0ac8b3484
SHA25678c622123e3d14a0a10b0244d0d9378b1c8d298180f58896f9ee1e52c0aa06c7
SHA512aae262bf30c9fc92ec823811b589930494c27e1f867d5fa2bb6ae1fcce8be01a7ca853671ed8b7a8c40624e205bb2d5a45a183fff91c222b04188a207a2fc7d6
-
memory/1172-20-0x000000007FE40000-0x000000007FE50000-memory.dmpFilesize
64KB
-
memory/1172-22-0x000000007FE30000-0x000000007FE40000-memory.dmpFilesize
64KB
-
memory/1172-21-0x000000007FE40000-0x000000007FE50000-memory.dmpFilesize
64KB
-
memory/1172-19-0x000000007FE40000-0x000000007FE50000-memory.dmpFilesize
64KB
-
memory/1172-18-0x000000007FE40000-0x000000007FE50000-memory.dmpFilesize
64KB
-
memory/1172-17-0x000000007FE40000-0x000000007FE50000-memory.dmpFilesize
64KB
-
memory/1172-14-0x0000000002590000-0x00000000025C6000-memory.dmpFilesize
216KB
-
memory/1172-7-0x0000000000670000-0x0000000000686000-memory.dmpFilesize
88KB
-
memory/1172-28-0x000000007FE40000-0x000000007FE50000-memory.dmpFilesize
64KB