Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:06
Static task
static1
Behavioral task
behavioral1
Sample
693c7294b4703f1fe906887d551ad748_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
693c7294b4703f1fe906887d551ad748_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
693c7294b4703f1fe906887d551ad748_JaffaCakes118.exe
-
Size
359KB
-
MD5
693c7294b4703f1fe906887d551ad748
-
SHA1
e1eccded6048e41b645e949d3c33d25fb19aad50
-
SHA256
4001936a832242e06c4858818b4488b2fc1b0b5ef418b304989bbcbef03aa1a2
-
SHA512
f5a4ec6703975f0d78aee8138b4b33cbd13b2dfe6b2dcde3b44a2e4ae86d44eb2179b386e838c44d49aa25789f6d69eb3c403ac1e5a4d9275f90c91a39298a98
-
SSDEEP
3072:/OSLZVvAt5/VzBbwWkyJbY97nXrg657sgDj0GF3gKzELJZ+q+SVmqQdQn6CXF/KH:/TLrv+VzfFgD4GFwKoV0q+A6MQCHbQY8
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
693c7294b4703f1fe906887d551ad748_JaffaCakes118.exepid process 1220 693c7294b4703f1fe906887d551ad748_JaffaCakes118.exe 1220 693c7294b4703f1fe906887d551ad748_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
693c7294b4703f1fe906887d551ad748_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main 693c7294b4703f1fe906887d551ad748_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
693c7294b4703f1fe906887d551ad748_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1220 693c7294b4703f1fe906887d551ad748_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
693c7294b4703f1fe906887d551ad748_JaffaCakes118.exepid process 1220 693c7294b4703f1fe906887d551ad748_JaffaCakes118.exe 1220 693c7294b4703f1fe906887d551ad748_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\693c7294b4703f1fe906887d551ad748_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\693c7294b4703f1fe906887d551ad748_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\jki2B74.tmpFilesize
262KB
MD594fc140eb98884d9f3e15bcce406f090
SHA1844f2ae6b598e0b29c22f2313594f0cbaf73b32c
SHA2560e1baa3cc4e981b9261861b2b042c083a0d277aba44d5cacad8ba6668d9dc7bd
SHA512c7d5987e6f548d44f5b586abe06b1926a5d51ffa486759de5026d743b1d81848e8a90841312f318574c39e7d69a9051bf42cba556f791061ab69c1e37d34cdff
-
memory/1220-9-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/1220-5-0x00000000003F0000-0x0000000000436000-memory.dmpFilesize
280KB
-
memory/1220-6-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/1220-7-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/1220-8-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/1220-1-0x000000007439E000-0x000000007439F000-memory.dmpFilesize
4KB
-
memory/1220-14-0x000000000CC40000-0x000000000D3E6000-memory.dmpFilesize
7.6MB
-
memory/1220-20-0x000000007439E000-0x000000007439F000-memory.dmpFilesize
4KB
-
memory/1220-21-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/1220-22-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/1220-23-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/1220-24-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB