Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 12:27
Static task
static1
Behavioral task
behavioral1
Sample
634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe
-
Size
380KB
-
MD5
634abd29ab5f0ca9608ba660f6518f31
-
SHA1
4cb24f4e8020a603f950de37fd6f2a4418796bdc
-
SHA256
14228af808c89b5e1fe2229e512bd036e33fbabea3b2a90ba8f884fe8c6c7357
-
SHA512
a1111877ce348931cc4037bd0798f4947557379a7390948c61841391db623960475ae14812309d6bd01916fb4f9b4cea27b8f684bb54b268ff725f4c6d99445a
-
SSDEEP
3072:/OvSgKVssaHwsdVXBVb4hssL86Qzrsut0e/x5J/JPBOysL5smLy/+dIL:/OvSnVywsdbzK6P/xhBKLo
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exeruleintel.exeruleintel.exepid process 1528 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe 1528 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe 3248 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe 3248 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe 4744 ruleintel.exe 4744 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe 888 ruleintel.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exepid process 3248 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exeruleintel.exedescription pid process target process PID 1528 wrote to memory of 3248 1528 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe PID 1528 wrote to memory of 3248 1528 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe PID 1528 wrote to memory of 3248 1528 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe PID 4744 wrote to memory of 888 4744 ruleintel.exe ruleintel.exe PID 4744 wrote to memory of 888 4744 ruleintel.exe ruleintel.exe PID 4744 wrote to memory of 888 4744 ruleintel.exe ruleintel.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:3248
-
C:\Windows\SysWOW64\ruleintel.exe"C:\Windows\SysWOW64\ruleintel.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\ruleintel.exe"C:\Windows\SysWOW64\ruleintel.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/888-27-0x0000000000820000-0x0000000000830000-memory.dmpFilesize
64KB
-
memory/888-26-0x00000000007E0000-0x00000000007F7000-memory.dmpFilesize
92KB
-
memory/888-25-0x0000000000800000-0x0000000000817000-memory.dmpFilesize
92KB
-
memory/888-21-0x0000000000800000-0x0000000000817000-memory.dmpFilesize
92KB
-
memory/888-31-0x00000000007E0000-0x00000000007F7000-memory.dmpFilesize
92KB
-
memory/1528-2-0x00000000007E0000-0x00000000007F7000-memory.dmpFilesize
92KB
-
memory/1528-4-0x00000000007E0000-0x00000000007F7000-memory.dmpFilesize
92KB
-
memory/1528-5-0x00000000007C0000-0x00000000007D7000-memory.dmpFilesize
92KB
-
memory/1528-6-0x0000000000800000-0x0000000000810000-memory.dmpFilesize
64KB
-
memory/3248-12-0x0000000000810000-0x0000000000827000-memory.dmpFilesize
92KB
-
memory/3248-29-0x0000000000850000-0x00000000008B5000-memory.dmpFilesize
404KB
-
memory/3248-30-0x0000000000810000-0x0000000000827000-memory.dmpFilesize
92KB
-
memory/3248-7-0x0000000000830000-0x0000000000847000-memory.dmpFilesize
92KB
-
memory/3248-13-0x0000000000AC0000-0x0000000000AD0000-memory.dmpFilesize
64KB
-
memory/3248-11-0x0000000000830000-0x0000000000847000-memory.dmpFilesize
92KB
-
memory/4744-20-0x0000000000F60000-0x0000000000F70000-memory.dmpFilesize
64KB
-
memory/4744-28-0x0000000000F20000-0x0000000000F37000-memory.dmpFilesize
92KB
-
memory/4744-19-0x0000000000F20000-0x0000000000F37000-memory.dmpFilesize
92KB
-
memory/4744-18-0x0000000000F40000-0x0000000000F57000-memory.dmpFilesize
92KB
-
memory/4744-14-0x0000000000F40000-0x0000000000F57000-memory.dmpFilesize
92KB