Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6957fc973e45d6362c9508297840332c_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
General
-
Target
6957fc973e45d6362c9508297840332c_JaffaCakes118.exe
-
Size
136KB
-
MD5
6957fc973e45d6362c9508297840332c
-
SHA1
6e52c02c3d9af028f9b3b4f3d2137a60eefba806
-
SHA256
c4eaf6517322d8c67f083aae15ca5c62c04c2ea8bc375b672a610fee1cc8cec4
-
SHA512
23667c36ee1739a3d33a37749bee492cf1a6a08ba345b4212efb0a318f36443242764e67692b9cf3bf70681f4012067173b3bc43bc73e49ce5df97aca788fe72
-
SSDEEP
3072:zsECkTUAq8oqBdjZGQ0MMopjFR4dm2dBbALbQYC:zsECkTJoqBdcfMvphuM2YLX
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
6957fc973e45d6362c9508297840332c_JaffaCakes118.exe6957fc973e45d6362c9508297840332c_JaffaCakes118.exestartedmetagen.exestartedmetagen.exepid process 3152 6957fc973e45d6362c9508297840332c_JaffaCakes118.exe 3152 6957fc973e45d6362c9508297840332c_JaffaCakes118.exe 3688 6957fc973e45d6362c9508297840332c_JaffaCakes118.exe 3688 6957fc973e45d6362c9508297840332c_JaffaCakes118.exe 3324 startedmetagen.exe 3324 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe 3960 startedmetagen.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6957fc973e45d6362c9508297840332c_JaffaCakes118.exepid process 3688 6957fc973e45d6362c9508297840332c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6957fc973e45d6362c9508297840332c_JaffaCakes118.exestartedmetagen.exedescription pid process target process PID 3152 wrote to memory of 3688 3152 6957fc973e45d6362c9508297840332c_JaffaCakes118.exe 6957fc973e45d6362c9508297840332c_JaffaCakes118.exe PID 3152 wrote to memory of 3688 3152 6957fc973e45d6362c9508297840332c_JaffaCakes118.exe 6957fc973e45d6362c9508297840332c_JaffaCakes118.exe PID 3152 wrote to memory of 3688 3152 6957fc973e45d6362c9508297840332c_JaffaCakes118.exe 6957fc973e45d6362c9508297840332c_JaffaCakes118.exe PID 3324 wrote to memory of 3960 3324 startedmetagen.exe startedmetagen.exe PID 3324 wrote to memory of 3960 3324 startedmetagen.exe startedmetagen.exe PID 3324 wrote to memory of 3960 3324 startedmetagen.exe startedmetagen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6957fc973e45d6362c9508297840332c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6957fc973e45d6362c9508297840332c_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6957fc973e45d6362c9508297840332c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6957fc973e45d6362c9508297840332c_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\startedmetagen.exe"C:\Windows\SysWOW64\startedmetagen.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\startedmetagen.exe"C:\Windows\SysWOW64\startedmetagen.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3152-4-0x0000000002B60000-0x0000000002B7A000-memory.dmpFilesize
104KB
-
memory/3152-0-0x0000000002B80000-0x0000000002B9A000-memory.dmpFilesize
104KB
-
memory/3152-5-0x0000000002BA0000-0x0000000002BB8000-memory.dmpFilesize
96KB
-
memory/3324-17-0x00000000016A0000-0x00000000016B8000-memory.dmpFilesize
96KB
-
memory/3324-12-0x0000000001680000-0x000000000169A000-memory.dmpFilesize
104KB
-
memory/3324-16-0x0000000001660000-0x000000000167A000-memory.dmpFilesize
104KB
-
memory/3688-11-0x0000000002D20000-0x0000000002D38000-memory.dmpFilesize
96KB
-
memory/3688-10-0x0000000002CE0000-0x0000000002CFA000-memory.dmpFilesize
104KB
-
memory/3688-6-0x0000000002D00000-0x0000000002D1A000-memory.dmpFilesize
104KB
-
memory/3688-25-0x0000000002CE0000-0x0000000002CFA000-memory.dmpFilesize
104KB
-
memory/3688-24-0x0000000000650000-0x0000000000673000-memory.dmpFilesize
140KB
-
memory/3960-18-0x0000000001AB0000-0x0000000001ACA000-memory.dmpFilesize
104KB
-
memory/3960-23-0x0000000001AD0000-0x0000000001AE8000-memory.dmpFilesize
96KB
-
memory/3960-22-0x0000000001A90000-0x0000000001AAA000-memory.dmpFilesize
104KB
-
memory/3960-26-0x0000000001A90000-0x0000000001AAA000-memory.dmpFilesize
104KB