Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:23
Static task
static1
Behavioral task
behavioral1
Sample
69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe
-
Size
313KB
-
MD5
69465d1d00ed016486496e0ccda6aa4b
-
SHA1
8303b641a7a7d91df48783bb55e6d0ca905cb2ca
-
SHA256
31bae4374d59b79ed51778e336fb08d842095fe02e7af35e59a2ee8920762f79
-
SHA512
06beb771ea1c40e263e3b1b10280b95db2ecee948435614991da43712f06453791245572883c3ba425daf754c879e8ac0d6dc15ae38142a2ee91c98b7bd0a06e
-
SSDEEP
6144:ArkA9uEo2S1YnQmCX492DkwNP3qpYF0lu7tIYxFtApNhiYLE2/5yr3+LijY3:Ark4u6/eIo4nlu7trxFtApfgMyrpjY3
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exepid process 3456 69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe 3456 69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe 3456 69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exepid process 3456 69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe 3456 69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exedescription pid process target process PID 3456 wrote to memory of 2632 3456 69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe cmd.exe PID 3456 wrote to memory of 2632 3456 69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe cmd.exe PID 3456 wrote to memory of 2632 3456 69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69465d1d00ed016486496e0ccda6aa4b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin6FE1.bat"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\InstallMate\D45BE883\cfg\1.iniFilesize
905B
MD54386579742c29a527d34276851fef80d
SHA109d69d909d53bda576397b03409480cedbb60c65
SHA256e4f23ba1036b36f1d8b06a02fb1994738976758d830ab2f5c10c23871463a10e
SHA512e52d554041c97233cba0756986eaf131be29781b52a9c3c4b9f6523b7f10d9ea285219906f43a0a99e183324d817a3f8a7f149ee281d002cf8338b6e946c9550
-
C:\Users\Admin\AppData\Local\Temp\Tsu2EE51CC2.dllFilesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
C:\Users\Admin\AppData\Local\Temp\_tin6FE1.batFilesize
50B
MD56baa35a944c4cd324c309bd35628a7de
SHA1e8cf687a6919970475a1e6eae2bc273ca4396b10
SHA2567a57c891e1fa010c8af76f2c316ddaa6340e5087ff0eaee8e581d6f9503881ac
SHA51288eca839cde967093755ac5e7b420d02039c4530f7ff8ad15ed72e2fd9491c712ae7617d1f72dd5c64b6def8feb6d600f385836f90e9bcd93e1cb8e7bc37b583
-
C:\Users\Admin\AppData\Local\Temp\{95FD7AA8-9ED1-4F06-ADED-D6F34E1E585E}\Custom.dllFilesize
91KB
MD5ed92e425cd374788afede25d2dd9d84a
SHA1666fcb0dc635af7ba075e48c8f8c72a16dd30a67
SHA256a50e3750c29b54f7b304064bb843972dba4094ee9ceef4e6942c61d2a5690d46
SHA5128afa88d37eaef17822c7fe9285f30d4766af63cabf0dea05b5e74b5a2cd5dfced7729418d42979a7ab006cda6a17731c59b93400c4f2be3f3b59e81e2800687d
-
C:\Users\Admin\AppData\Local\Temp\{95FD7AA8-9ED1-4F06-ADED-D6F34E1E585E}\Readme.txtFilesize
2KB
MD54a8f844355927fbe8bd85e03aab45e0b
SHA19d978f61b6a6ce746de4bbde9e1252575ca28caf
SHA256d98c50857b3915c7af124a2982165e6139cc378aaad92df699ca2cc95c930d08
SHA512f912d4bc848eab7d1d39e75448e6b81ef313bed2426a06524ddc1162b2ed379ed16aad362e3576419a56979c5926c0e64f8316e08dce38fa573a43be2f247727
-
C:\Users\Admin\AppData\Local\Temp\{95FD7AA8-9ED1-4F06-ADED-D6F34E1E585E}\Setup.exeFilesize
15KB
MD5e717f6ce3a7429bfa6d7f3cf66737a4b
SHA101f4042589b4ed88c351ffeac256be7a9d884818
SHA2567be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633
SHA51265a9a27430811aa01b55cf365f8b7b9f03e70d32ec60e0706242bc568242bcd493999dc1b02d92bf0d01c0095c8c38d30f282a998cafb80e60ad07e0d875ce80
-
C:\Users\Admin\AppData\Local\Temp\{95FD7AA8-9ED1-4F06-ADED-D6F34E1E585E}\Setup.icoFilesize
4KB
MD5c3926cef276c0940dadbc8142153cec9
SHA1f8b350d2b7158f5ab147938961439860d77b9cb4
SHA2560ec48e3c1886bc0169a4bc262f012e9b7914e3b440bb0ecc4d8123924abc9b93
SHA5125b9958095b8a7b39b3a2226a5242faec8d2d799d10e1e4ed6dbfb8aaebe51b7496cf4bb5ad588366a296671df3ba46a3f42860abc7f9501b4cc5efd55dd87904
-
C:\Users\Admin\AppData\Local\Temp\{95FD7AA8-9ED1-4F06-ADED-D6F34E1E585E}\_Setup.dllFilesize
169KB
MD5204a2b4cd7d5022c92d0d15d33051795
SHA17742a0d36b16c07dde8c2d29b8d2bbeed17130d2
SHA256d6267d0770d1e2ae443e2217ed5f326cf17a0a67454783af4e109db5f040fe85
SHA512b4aeda6dbb92e070a5d650dfe28f1c0fac5125d9bc1603c8321124aa335d4842da774d68dc6c0f6415579b337a3527d991bc444e5a6167c672f8920759de86e3