Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe
-
Size
718KB
-
MD5
5810cb4fee212c13f3300a6ae54e791d
-
SHA1
e968629fece2594d3eb9a2304b9d133fc5070f9e
-
SHA256
b2994dd9a0134b56802b5783c4601f7b5133ce147e91f6f78eecccf376bfc0d9
-
SHA512
d380b2b7ce5dd177a8b4a238b3672cea87b464cb82512c59de6504f90f35c0752654878f0ed878c6556f7d86d15571e5c76392ef2e53a8f3fd2d04ab88ba08a4
-
SSDEEP
3072:B61MNCCQd/A6i+6zbzRNEtc+E1jA4yWIlqZg+LDRfjirr:3w5/5gzbzRfVyrZ+pir
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exeandroidarchive.exeandroidarchive.exepid process 3560 5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe 3560 5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe 2724 5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe 2724 5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe 1272 androidarchive.exe 1272 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe 1664 androidarchive.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exepid process 2724 5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exeandroidarchive.exedescription pid process target process PID 3560 wrote to memory of 2724 3560 5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe 5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe PID 3560 wrote to memory of 2724 3560 5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe 5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe PID 3560 wrote to memory of 2724 3560 5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe 5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe PID 1272 wrote to memory of 1664 1272 androidarchive.exe androidarchive.exe PID 1272 wrote to memory of 1664 1272 androidarchive.exe androidarchive.exe PID 1272 wrote to memory of 1664 1272 androidarchive.exe androidarchive.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5810cb4fee212c13f3300a6ae54e791d_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\androidarchive.exe"C:\Windows\SysWOW64\androidarchive.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\androidarchive.exe"C:\Windows\SysWOW64\androidarchive.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1272-13-0x0000000000DB0000-0x0000000000DC7000-memory.dmpFilesize
92KB
-
memory/1272-27-0x0000000000DB0000-0x0000000000DC7000-memory.dmpFilesize
92KB
-
memory/1272-19-0x0000000000DF0000-0x0000000000E00000-memory.dmpFilesize
64KB
-
memory/1272-18-0x0000000000DD0000-0x0000000000DE7000-memory.dmpFilesize
92KB
-
memory/1272-14-0x0000000000DD0000-0x0000000000DE7000-memory.dmpFilesize
92KB
-
memory/1664-26-0x0000000000650000-0x0000000000660000-memory.dmpFilesize
64KB
-
memory/1664-24-0x0000000000DE0000-0x0000000000DF7000-memory.dmpFilesize
92KB
-
memory/1664-20-0x0000000000DE0000-0x0000000000DF7000-memory.dmpFilesize
92KB
-
memory/1664-25-0x0000000000DC0000-0x0000000000DD7000-memory.dmpFilesize
92KB
-
memory/1664-30-0x0000000000DC0000-0x0000000000DD7000-memory.dmpFilesize
92KB
-
memory/2724-12-0x0000000000650000-0x0000000000667000-memory.dmpFilesize
92KB
-
memory/2724-29-0x0000000000650000-0x0000000000667000-memory.dmpFilesize
92KB
-
memory/2724-28-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/3560-5-0x0000000000650000-0x0000000000667000-memory.dmpFilesize
92KB
-
memory/3560-6-0x0000000000690000-0x00000000006A0000-memory.dmpFilesize
64KB
-
memory/3560-4-0x0000000000670000-0x0000000000687000-memory.dmpFilesize
92KB
-
memory/3560-0-0x0000000000670000-0x0000000000687000-memory.dmpFilesize
92KB