Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:46
Static task
static1
Behavioral task
behavioral1
Sample
65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe
-
Size
471KB
-
MD5
65be8c88b60ace74d5782e4c3b5ae74f
-
SHA1
d04c965a9d071ee5cb7dae7077e295ed4ad259a4
-
SHA256
1172ffa7cd7b3b619eebbf27b7642bc44698c0faa1379d91380495fede507f36
-
SHA512
805bd87488528614dfa40b2d4acad86ca7db55817aa751a7a057e4790d57291cb6de9db60eb760bc37fb7ff604c1b663d337ba7b1e383271e3ad505520d7c0b5
-
SSDEEP
6144:9msyd7BspOWZ+Stxo3Gc2uqy3gu88mWCMpCRWFf2Kj+m+6XjYA1:ppO3StxwGc2c3tfmfsCRA22+m+8f1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
worker.exepid process 2160 worker.exe -
Loads dropped DLL 1 IoCs
Processes:
65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exepid process 3020 65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
worker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main worker.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
worker.exedescription pid process Token: SeDebugPrivilege 2160 worker.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
worker.exepid process 2160 worker.exe 2160 worker.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exedescription pid process target process PID 3020 wrote to memory of 2160 3020 65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe worker.exe PID 3020 wrote to memory of 2160 3020 65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe worker.exe PID 3020 wrote to memory of 2160 3020 65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe worker.exe PID 3020 wrote to memory of 2160 3020 65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe worker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DM\parent.txtFilesize
471KB
MD565be8c88b60ace74d5782e4c3b5ae74f
SHA1d04c965a9d071ee5cb7dae7077e295ed4ad259a4
SHA2561172ffa7cd7b3b619eebbf27b7642bc44698c0faa1379d91380495fede507f36
SHA512805bd87488528614dfa40b2d4acad86ca7db55817aa751a7a057e4790d57291cb6de9db60eb760bc37fb7ff604c1b663d337ba7b1e383271e3ad505520d7c0b5
-
\Users\Admin\AppData\Local\Temp\DM\worker.exeFilesize
19KB
MD52b23c69b68708c14fc214c3454e6b1bd
SHA15c923d25c14ad13dab4f05bb1423026f873e7dc4
SHA256b2eb3b20cfa82a80207cb9fe8ea7cb28faa1b35612816b7b0052e68b9c8068bd
SHA51200135ff0664e9de5f98be600773c72025f5f338e7301ab9d10b023fef672baa2ddbe3124813352eacf8d7475f0905d68dded619aa2cc3099f10b943ff3cdb8c5
-
memory/2160-10-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmpFilesize
9.6MB
-
memory/2160-24-0x0000000021F80000-0x0000000022726000-memory.dmpFilesize
7.6MB
-
memory/2160-8-0x0000000002090000-0x00000000020D4000-memory.dmpFilesize
272KB
-
memory/2160-11-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmpFilesize
9.6MB
-
memory/2160-12-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmpFilesize
9.6MB
-
memory/2160-13-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmpFilesize
9.6MB
-
memory/2160-7-0x000007FEF57CE000-0x000007FEF57CF000-memory.dmpFilesize
4KB
-
memory/2160-9-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmpFilesize
9.6MB
-
memory/2160-25-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmpFilesize
9.6MB
-
memory/2160-26-0x000007FEF57CE000-0x000007FEF57CF000-memory.dmpFilesize
4KB
-
memory/2160-27-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmpFilesize
9.6MB
-
memory/2160-28-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmpFilesize
9.6MB
-
memory/2160-29-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmpFilesize
9.6MB
-
memory/2160-30-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmpFilesize
9.6MB