Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-04-2024 02:48

General

  • Target

    08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe

  • Size

    120KB

  • MD5

    08dac7cd7811478ca3034abea01f7ef3

  • SHA1

    39fb4257800f4ea0225f5dbd3f6784148d8a0b35

  • SHA256

    11dbb021b663c84e26663121e993e3384f793267426373e8e1b0e5d335fb22ba

  • SHA512

    e17ce09a80f3141399a75ca7bba7f24d7a8f3b40cea23654b2cd6e94e3c854627c50acb23845e7a882d74abb94e4c400829183fd60af6c4851052fb9e4d58d52

  • SSDEEP

    3072:jsSVfjdK41ap0intKLzKhiEQnE4qXYjXqX:jsSxw41aSitSOhiEQdAX

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3912
    • C:\Users\Admin\AppData\Local\Temp\08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe
      --96f82519
      2⤵
      • Suspicious behavior: RenamesItself
      PID:1424
  • C:\Windows\SysWOW64\matrixcycle.exe
    "C:\Windows\SysWOW64\matrixcycle.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3472
    • C:\Windows\SysWOW64\matrixcycle.exe
      --de40dafb
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:3388

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • 190.173.155.124:443
    matrixcycle.exe
    260 B
    5
  • 189.131.189.158:443
    matrixcycle.exe
    260 B
    5
  • 45.79.72.132:443
    matrixcycle.exe
    260 B
    5
  • 136.243.117.85:8080
    matrixcycle.exe
    260 B
    5
  • 104.236.135.119:8080
    matrixcycle.exe
    156 B
    3
  • 8.8.8.8:53
    g.bing.com
    dns
    280 B
    5

    DNS Request

    g.bing.com

    DNS Request

    g.bing.com

    DNS Request

    g.bing.com

    DNS Request

    g.bing.com

    DNS Request

    g.bing.com

  • 8.8.8.8:53
    g.bing.com
    dns
    280 B
    5

    DNS Request

    g.bing.com

    DNS Request

    g.bing.com

    DNS Request

    g.bing.com

    DNS Request

    g.bing.com

    DNS Request

    g.bing.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1424-4-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1424-8-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3388-10-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3388-13-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3912-0-0x0000000002060000-0x0000000002071000-memory.dmp

    Filesize

    68KB

  • memory/3912-1-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3912-3-0x0000000002060000-0x0000000002071000-memory.dmp

    Filesize

    68KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.