Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 14:17
Static task
static1
Behavioral task
behavioral1
Sample
5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe
-
Size
477KB
-
MD5
5524511b34816ee595b195eebe2495bb
-
SHA1
4addb2bde53dbb7a04b2e136c3d93cf75f36adaf
-
SHA256
63bd217be3952557996bc345d669c76d83a8e1af58dab83ec6365ecfacd3d469
-
SHA512
01ec817cbbcf0428a8dd44e838ab506eafe9eeacc44dfd65b8b225156baaf58980cc46bad06552ad309369a1f29fe302eef59cb70bf60e9519e8e74230bb82ef
-
SSDEEP
6144:VTphC6SMy1ioBj48nVyjfJ68TBaKD1YUSxy7fMP5oKB3DS1bD:JC6SMOLFEx/TBaKWw1bD
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe5524511b34816ee595b195eebe2495bb_JaffaCakes118.exenicmore.exenicmore.exepid process 4496 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe 4496 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe 3532 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe 3532 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe 3984 nicmore.exe 3984 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe 3500 nicmore.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
5524511b34816ee595b195eebe2495bb_JaffaCakes118.exepid process 3532 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5524511b34816ee595b195eebe2495bb_JaffaCakes118.exenicmore.exedescription pid process target process PID 4496 wrote to memory of 3532 4496 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe PID 4496 wrote to memory of 3532 4496 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe PID 4496 wrote to memory of 3532 4496 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe PID 3984 wrote to memory of 3500 3984 nicmore.exe nicmore.exe PID 3984 wrote to memory of 3500 3984 nicmore.exe nicmore.exe PID 3984 wrote to memory of 3500 3984 nicmore.exe nicmore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\nicmore.exe"C:\Windows\SysWOW64\nicmore.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nicmore.exe"C:\Windows\SysWOW64\nicmore.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3500-30-0x0000000000DB0000-0x0000000000DC6000-memory.dmpFilesize
88KB
-
memory/3500-26-0x0000000000DB0000-0x0000000000DC6000-memory.dmpFilesize
88KB
-
memory/3532-12-0x00000000012A0000-0x00000000012B6000-memory.dmpFilesize
88KB
-
memory/3532-9-0x00000000012A0000-0x00000000012B6000-memory.dmpFilesize
88KB
-
memory/3532-33-0x0000000001280000-0x0000000001296000-memory.dmpFilesize
88KB
-
memory/3532-15-0x00000000012C0000-0x00000000012D0000-memory.dmpFilesize
64KB
-
memory/3532-14-0x0000000001280000-0x0000000001296000-memory.dmpFilesize
88KB
-
memory/3532-32-0x0000000000A60000-0x0000000000ADC000-memory.dmpFilesize
496KB
-
memory/3984-24-0x0000000001080000-0x0000000001090000-memory.dmpFilesize
64KB
-
memory/3984-18-0x0000000000F30000-0x0000000000F46000-memory.dmpFilesize
88KB
-
memory/3984-23-0x0000000001060000-0x0000000001076000-memory.dmpFilesize
88KB
-
memory/3984-19-0x0000000001060000-0x0000000001076000-memory.dmpFilesize
88KB
-
memory/3984-31-0x0000000000F30000-0x0000000000F46000-memory.dmpFilesize
88KB
-
memory/4496-4-0x0000000000C00000-0x0000000000C16000-memory.dmpFilesize
88KB
-
memory/4496-16-0x0000000000BE0000-0x0000000000BF6000-memory.dmpFilesize
88KB
-
memory/4496-1-0x0000000000BE0000-0x0000000000BF6000-memory.dmpFilesize
88KB
-
memory/4496-6-0x0000000000C00000-0x0000000000C16000-memory.dmpFilesize
88KB
-
memory/4496-13-0x0000000000C20000-0x0000000000C30000-memory.dmpFilesize
64KB