Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe
-
Size
120KB
-
MD5
6c757d678105b9c79e56aeae552871b2
-
SHA1
53e9563337201cef300c192de8fc9c20688e6d69
-
SHA256
392b1e9b1d943bf15c0668b0494fdb1a23eb57f44e0afae26ebcf9ed356528e4
-
SHA512
30711d53941c43ab17f51eec1171542013899382b53e4e5c32e81cd46925be35fc4eae58fa1e41ff27db1fe3c6a0289332a58cb6b9738e655ac2cdb0dd4c85c6
-
SSDEEP
1536:hh+VKbz74iVTtbnEQhhSqklN4oyk2tO+ELlDStvvztFTzmcK:hhTHMi/EQORlyk28J2dvZN5K
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exeboostrule.exeboostrule.exepid process 2892 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe 2892 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe 2104 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe 2104 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe 3184 boostrule.exe 3184 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe 2056 boostrule.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exepid process 2104 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exeboostrule.exedescription pid process target process PID 2892 wrote to memory of 2104 2892 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe PID 2892 wrote to memory of 2104 2892 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe PID 2892 wrote to memory of 2104 2892 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe PID 3184 wrote to memory of 2056 3184 boostrule.exe boostrule.exe PID 3184 wrote to memory of 2056 3184 boostrule.exe boostrule.exe PID 3184 wrote to memory of 2056 3184 boostrule.exe boostrule.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2104
-
C:\Windows\SysWOW64\boostrule.exe"C:\Windows\SysWOW64\boostrule.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\boostrule.exe"C:\Windows\SysWOW64\boostrule.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2056-23-0x00000000006F0000-0x0000000000708000-memory.dmpFilesize
96KB
-
memory/2056-26-0x0000000000590000-0x00000000005A7000-memory.dmpFilesize
92KB
-
memory/2056-18-0x00000000005B0000-0x00000000005C7000-memory.dmpFilesize
92KB
-
memory/2056-22-0x0000000000590000-0x00000000005A7000-memory.dmpFilesize
92KB
-
memory/2104-11-0x0000000000A20000-0x0000000000A38000-memory.dmpFilesize
96KB
-
memory/2104-10-0x00000000006E0000-0x00000000006F7000-memory.dmpFilesize
92KB
-
memory/2104-25-0x00000000006E0000-0x00000000006F7000-memory.dmpFilesize
92KB
-
memory/2104-24-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2892-0-0x0000000000A00000-0x0000000000A17000-memory.dmpFilesize
92KB
-
memory/2892-4-0x00000000009E0000-0x00000000009F7000-memory.dmpFilesize
92KB
-
memory/2892-5-0x0000000000A20000-0x0000000000A38000-memory.dmpFilesize
96KB
-
memory/3184-12-0x0000000000D30000-0x0000000000D47000-memory.dmpFilesize
92KB
-
memory/3184-17-0x0000000000D50000-0x0000000000D68000-memory.dmpFilesize
96KB
-
memory/3184-16-0x0000000000D10000-0x0000000000D27000-memory.dmpFilesize
92KB