Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 05:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6620336a6a602d98076733fe042d154d_JaffaCakes118.exe
Resource
win7-20240221-en
7 signatures
150 seconds
General
-
Target
6620336a6a602d98076733fe042d154d_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
6620336a6a602d98076733fe042d154d
-
SHA1
8c4163fc85be743836a407a9e262aac40880a92a
-
SHA256
95f33ec8115346b3cc2206125b265640c9df439275d4694b05de7d61c4c3cedb
-
SHA512
df94df992bec3b37eb745003b911e9c048036cda3f8237a15200c78096fb9f4c264c3cf1a1c566c6d9bf40f9b6c76c2dbde789ecd9a9cafa6be72b066ef37af8
-
SSDEEP
6144:VbXa0LFTuJQ3/j3zgZELr1VBNj082BJr3k3xUOVs3DVf81GoyHn7kOpN50IKOOqG:Vu0RTBPjkK/jH2fIGOVoDJLvfOqsUFY
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4132 6620336a6a602d98076733fe042d154d_JaffaCakes118.exe 4132 6620336a6a602d98076733fe042d154d_JaffaCakes118.exe 3248 6620336a6a602d98076733fe042d154d_JaffaCakes118.exe 3248 6620336a6a602d98076733fe042d154d_JaffaCakes118.exe 1228 engnsensor.exe 1228 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe 3016 engnsensor.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3248 6620336a6a602d98076733fe042d154d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4132 wrote to memory of 3248 4132 6620336a6a602d98076733fe042d154d_JaffaCakes118.exe 83 PID 4132 wrote to memory of 3248 4132 6620336a6a602d98076733fe042d154d_JaffaCakes118.exe 83 PID 4132 wrote to memory of 3248 4132 6620336a6a602d98076733fe042d154d_JaffaCakes118.exe 83 PID 1228 wrote to memory of 3016 1228 engnsensor.exe 94 PID 1228 wrote to memory of 3016 1228 engnsensor.exe 94 PID 1228 wrote to memory of 3016 1228 engnsensor.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\6620336a6a602d98076733fe042d154d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6620336a6a602d98076733fe042d154d_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\6620336a6a602d98076733fe042d154d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6620336a6a602d98076733fe042d154d_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:3248
-
-
C:\Windows\SysWOW64\engnsensor.exe"C:\Windows\SysWOW64\engnsensor.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\engnsensor.exe"C:\Windows\SysWOW64\engnsensor.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3016
-