Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 18:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
General
-
Target
6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe
-
Size
792KB
-
MD5
6823e6e9a4321cfda0767502921358e3
-
SHA1
fafede3014a8389192d913a1ed0edf83ca237482
-
SHA256
63b0ecc943fce32c509e12af374918b7d0c9c65663f5b2e100facc2faee1dc81
-
SHA512
e33c917a3b25004dab4808f96dff6e53d16a93402722128ed7e5ae830121dc0bcd7a7de7f73c1bf39336a189438bf9dfbdc6e20aa6b96af518af1dd849e6e330
-
SSDEEP
24576:cz3UzEaVPbn6i7xFkOM77BBuo3rHE5ijM5afM5:wOVPbn6i7xFkOM77BBuo3rHE5ijM5af2
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exeshimsasp.exeshimsasp.exepid process 5036 6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe 5036 6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe 1684 6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe 1684 6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe 2208 shimsasp.exe 2208 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe 2992 shimsasp.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exepid process 1684 6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exeshimsasp.exedescription pid process target process PID 5036 wrote to memory of 1684 5036 6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe 6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe PID 5036 wrote to memory of 1684 5036 6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe 6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe PID 5036 wrote to memory of 1684 5036 6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe 6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe PID 2208 wrote to memory of 2992 2208 shimsasp.exe shimsasp.exe PID 2208 wrote to memory of 2992 2208 shimsasp.exe shimsasp.exe PID 2208 wrote to memory of 2992 2208 shimsasp.exe shimsasp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6823e6e9a4321cfda0767502921358e3_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:1684
-
C:\Windows\SysWOW64\shimsasp.exe"C:\Windows\SysWOW64\shimsasp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\shimsasp.exe"C:\Windows\SysWOW64\shimsasp.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1684-12-0x0000000000670000-0x0000000000689000-memory.dmpFilesize
100KB
-
memory/1684-25-0x0000000000400000-0x00000000004C8000-memory.dmpFilesize
800KB
-
memory/1684-26-0x0000000000650000-0x0000000000669000-memory.dmpFilesize
100KB
-
memory/1684-7-0x0000000000650000-0x0000000000669000-memory.dmpFilesize
100KB
-
memory/1684-8-0x0000000000670000-0x0000000000689000-memory.dmpFilesize
100KB
-
memory/1684-13-0x0000000000690000-0x00000000006A0000-memory.dmpFilesize
64KB
-
memory/2208-24-0x0000000000650000-0x0000000000669000-memory.dmpFilesize
100KB
-
memory/2992-19-0x0000000000DF0000-0x0000000000E09000-memory.dmpFilesize
100KB
-
memory/2992-23-0x0000000000DF0000-0x0000000000E09000-memory.dmpFilesize
100KB
-
memory/5036-4-0x00000000006B0000-0x00000000006C9000-memory.dmpFilesize
100KB
-
memory/5036-5-0x0000000000690000-0x00000000006A9000-memory.dmpFilesize
100KB
-
memory/5036-6-0x00000000006D0000-0x00000000006E0000-memory.dmpFilesize
64KB
-
memory/5036-0-0x00000000006B0000-0x00000000006C9000-memory.dmpFilesize
100KB