Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:32
Static task
static1
Behavioral task
behavioral1
Sample
694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe
-
Size
284KB
-
MD5
694c8212ce7cf8e6fbbbefe183a9ad27
-
SHA1
7715da16e471c92c6f09ee1a75968fc4411b2397
-
SHA256
1d868e84fbc8e712a9c55beb9775a9d71a409caa4fc7098f77b96e3057c37756
-
SHA512
d11799cad30ec4bf68713976de390e034fb405f88c259f22bc5ab3404a6d3a33084e6fb9124269415f11ba82369c286c6e72f2533385525c6fa32f1ecf479b0a
-
SSDEEP
6144:pG1Af3k5aL3Lbii5bkgVuN+xSKV7Wkrsf7LsMKceSK:pGaf05a7XikbkgaISKVsVe3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
22960FD3-14E8-4DA4-B78A-B582DCDD0797.exepid process 2632 22960FD3-14E8-4DA4-B78A-B582DCDD0797.exe -
Loads dropped DLL 5 IoCs
Processes:
694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exepid process 2260 694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe 2260 694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe 2260 694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe 2260 694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe 2260 694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exedescription pid process target process PID 2260 wrote to memory of 2632 2260 694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe 22960FD3-14E8-4DA4-B78A-B582DCDD0797.exe PID 2260 wrote to memory of 2632 2260 694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe 22960FD3-14E8-4DA4-B78A-B582DCDD0797.exe PID 2260 wrote to memory of 2632 2260 694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe 22960FD3-14E8-4DA4-B78A-B582DCDD0797.exe PID 2260 wrote to memory of 2632 2260 694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe 22960FD3-14E8-4DA4-B78A-B582DCDD0797.exe PID 2260 wrote to memory of 2824 2260 694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe mshta.exe PID 2260 wrote to memory of 2824 2260 694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe mshta.exe PID 2260 wrote to memory of 2824 2260 694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe mshta.exe PID 2260 wrote to memory of 2824 2260 694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\eb3a954b-8e6c-45c6-9d18-2b4519b99c08\22960FD3-14E8-4DA4-B78A-B582DCDD0797.exe"C:\Users\Admin\AppData\Local\Temp\eb3a954b-8e6c-45c6-9d18-2b4519b99c08\22960FD3-14E8-4DA4-B78A-B582DCDD0797.exe" -y -p24209C29-927D-4216-9B7E-2304351D788C2⤵
- Executes dropped EXE
PID:2632 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\\eb3a954b-8e6c-45c6-9d18-2b4519b99c08\\start.hta2⤵
- Modifies Internet Explorer settings
PID:2824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e88ebd85dd56110ac6ea93fe0922988e
SHA1684a31d864d33ff736234c41ac4e8d2c7f90d5ae
SHA256379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb
SHA512211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7
-
Filesize
1KB
MD5580c0c72b17ffcb9a626356f7393d89c
SHA17a5e408abd57f8e2cc6f4fdd7f116fac04eb8a83
SHA256879b0caf66aca0fc0f9558a09d86480a64bf34cacd5094a572d779a6d65bf00b
SHA5129fc56f0916b75e03bca8654a2243fc0063a5baece46f648d67cb6f1876aa6aedebc55c1f1458baf2b2883ab1ec91973b6099918aae3269b91b76e627d6b19dac
-
\Users\Admin\AppData\Local\Temp\eb3a954b-8e6c-45c6-9d18-2b4519b99c08\22960FD3-14E8-4DA4-B78A-B582DCDD0797.exe
Filesize150KB
MD5069687d64f5ea09d060799c132243f15
SHA113b9041fd970aea78c2eac9e664e0e18b7956548
SHA25690252a4cc1ceb2c78b65bb4833b83a5ee81600a27ea337f908d16bbcb7018c16
SHA5127ed2b27e808c46723f56a064bea544bb45476304900dd9dbc5ccb4891dc3e288117eb2cb218fb9b6351296e1a5dcc5a7029ceb47f9bbac0e69376064fd831906