Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 03:15
Static task
static1
Behavioral task
behavioral1
Sample
1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe
-
Size
621KB
-
MD5
1157923e5cd51d747faf266da4e22de5
-
SHA1
fc2cd39cfae0b4f5ea343e6286e3e98147fac320
-
SHA256
9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760
-
SHA512
668e34d0dd732915573e99cae4fb5b7de590f89824fc1142ae3b5fd737af0489be5f69ca9121f8e80f2cb380795ca95addb582ef22a214942f0cc74e1f892a1f
-
SSDEEP
12288:ACL1cBficFlfKUMXSxY8L/RMkH6d2c60NPgMS6gl0tfqdlW3fp+4V1H/eu1D1S3L:TRchPoU/M2USQYs
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
Processes:
WerFault.exepid process 2732 WerFault.exe 2732 WerFault.exe 2732 WerFault.exe 2732 WerFault.exe 2732 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2732 2936 WerFault.exe 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe -
NTFS ADS 2 IoCs
Processes:
cmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe:Zone.Identifier cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2936 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exedescription pid process target process PID 2936 wrote to memory of 2940 2936 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe cmd.exe PID 2936 wrote to memory of 2940 2936 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe cmd.exe PID 2936 wrote to memory of 2940 2936 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe cmd.exe PID 2936 wrote to memory of 2940 2936 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe cmd.exe PID 2936 wrote to memory of 3044 2936 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe cmd.exe PID 2936 wrote to memory of 3044 2936 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe cmd.exe PID 2936 wrote to memory of 3044 2936 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe cmd.exe PID 2936 wrote to memory of 3044 2936 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe cmd.exe PID 2936 wrote to memory of 2732 2936 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe WerFault.exe PID 2936 wrote to memory of 2732 2936 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe WerFault.exe PID 2936 wrote to memory of 2732 2936 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe WerFault.exe PID 2936 wrote to memory of 2732 2936 1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 17602⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\1157923e5cd51d747faf266da4e22de5_JaffaCakes118.exeFilesize
621KB
MD51157923e5cd51d747faf266da4e22de5
SHA1fc2cd39cfae0b4f5ea343e6286e3e98147fac320
SHA2569f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760
SHA512668e34d0dd732915573e99cae4fb5b7de590f89824fc1142ae3b5fd737af0489be5f69ca9121f8e80f2cb380795ca95addb582ef22a214942f0cc74e1f892a1f
-
memory/2936-0-0x00000000742CE000-0x00000000742CF000-memory.dmpFilesize
4KB
-
memory/2936-1-0x0000000000800000-0x00000000008A2000-memory.dmpFilesize
648KB
-
memory/2936-2-0x0000000000230000-0x0000000000258000-memory.dmpFilesize
160KB
-
memory/2936-3-0x00000000742C0000-0x00000000749AE000-memory.dmpFilesize
6.9MB
-
memory/2936-4-0x00000000007E0000-0x00000000007E8000-memory.dmpFilesize
32KB
-
memory/2936-5-0x0000000001F80000-0x0000000001F8C000-memory.dmpFilesize
48KB
-
memory/2936-6-0x00000000742CE000-0x00000000742CF000-memory.dmpFilesize
4KB
-
memory/2936-7-0x00000000742C0000-0x00000000749AE000-memory.dmpFilesize
6.9MB
-
memory/2936-8-0x0000000002070000-0x000000000207C000-memory.dmpFilesize
48KB