Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 04:53
Static task
static1
Behavioral task
behavioral1
Sample
69ca0c3ee4af9b71ba0f4e5073286a83_JaffaCakes118.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
69ca0c3ee4af9b71ba0f4e5073286a83_JaffaCakes118.jar
Resource
win10v2004-20240508-en
General
-
Target
69ca0c3ee4af9b71ba0f4e5073286a83_JaffaCakes118.jar
-
Size
56KB
-
MD5
69ca0c3ee4af9b71ba0f4e5073286a83
-
SHA1
faae201be677ac142c14fdfb44d3f9425205decd
-
SHA256
7b696ec4ffe8f27becfbd19e7e88e6abe3c63d83b7772b8786b8035609536208
-
SHA512
6b70dd4908e644468a8d25b71fa1bc39bb5b8310f73899c7984b449aeff1caa7d98344767faa9646308bdc3209cb4cfbbd80524a32430947264ef873c697d1e0
-
SSDEEP
768:nVsdNOkiSQeBHvM7VtdLMd6GVjQwNFDF5FhfrOmKMNKegTocq2/aoZ35XSkIvpS6:nVseNSlH0htdLMd6GVj9H7+MN/uu18XK
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 3668 wrote to memory of 880 3668 java.exe icacls.exe PID 3668 wrote to memory of 880 3668 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\69ca0c3ee4af9b71ba0f4e5073286a83_JaffaCakes118.jar1⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD57ae799488e6844e0dd579ea9839e42e7
SHA18a915ab7203f9054f455a1d2aa4a6540ad23f347
SHA256c362ffa66e730abe9e453b8ec543aebfd3d152b78dbb809f9035a4f027ee4bf0
SHA5128282608d805947003b3fbd7317356e116589a4cec25437ffcf17c235fec487551c2c7471ca2c60a59c3c2b4d40cb3dfb263b68cc15237dc66334fbbf54a58320
-
memory/3668-2-0x0000023232540000-0x00000232327B0000-memory.dmpFilesize
2.4MB
-
memory/3668-13-0x0000023230D60000-0x0000023230D61000-memory.dmpFilesize
4KB
-
memory/3668-14-0x0000023232540000-0x00000232327B0000-memory.dmpFilesize
2.4MB