Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 05:37
Static task
static1
Behavioral task
behavioral1
Sample
69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe
-
Size
152KB
-
MD5
69e783c15eae02db57c599d15e4cf81e
-
SHA1
a27a634690f5d2fafe0efa669e4fe6aef47b34ed
-
SHA256
00b8d306a8328ed3bb0693ef756ea4d494af85c7af19be0d8d5306f32d20282c
-
SHA512
2c415df46eb5aca6633a622be89125527b7c57564af57862fd745641bed7bd29948ee24fb0f11a51207908a5d3a6c97fc05957f269428dc6fe29afb02081bf7c
-
SSDEEP
3072:S9rigXIEIK7f5cLhYK1P6U87XhrYaYSgmD/28P5Eb5JXfkY:S9rigXRIKDGd1P6d7RYaYED/2s2v
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exeadminiprop.exeadminiprop.exepid process 2760 69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe 2760 69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe 1056 69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe 1056 69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe 3388 adminiprop.exe 3388 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe 4772 adminiprop.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exepid process 1056 69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exeadminiprop.exedescription pid process target process PID 2760 wrote to memory of 1056 2760 69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe 69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe PID 2760 wrote to memory of 1056 2760 69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe 69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe PID 2760 wrote to memory of 1056 2760 69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe 69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe PID 3388 wrote to memory of 4772 3388 adminiprop.exe adminiprop.exe PID 3388 wrote to memory of 4772 3388 adminiprop.exe adminiprop.exe PID 3388 wrote to memory of 4772 3388 adminiprop.exe adminiprop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69e783c15eae02db57c599d15e4cf81e_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\adminiprop.exe"C:\Windows\SysWOW64\adminiprop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\adminiprop.exe"C:\Windows\SysWOW64\adminiprop.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1056-29-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1056-11-0x00000000005D0000-0x00000000005EA000-memory.dmpFilesize
104KB
-
memory/1056-14-0x00000000005F0000-0x0000000000610000-memory.dmpFilesize
128KB
-
memory/1056-13-0x00000000004D0000-0x00000000004EA000-memory.dmpFilesize
104KB
-
memory/1056-7-0x00000000005D0000-0x00000000005EA000-memory.dmpFilesize
104KB
-
memory/1056-30-0x00000000004D0000-0x00000000004EA000-memory.dmpFilesize
104KB
-
memory/2760-6-0x00000000020C0000-0x00000000020E0000-memory.dmpFilesize
128KB
-
memory/2760-1-0x00000000020A0000-0x00000000020BA000-memory.dmpFilesize
104KB
-
memory/2760-5-0x00000000005D0000-0x00000000005EA000-memory.dmpFilesize
104KB
-
memory/2760-12-0x00000000005D0000-0x00000000005EA000-memory.dmpFilesize
104KB
-
memory/2760-4-0x00000000020A0000-0x00000000020BA000-memory.dmpFilesize
104KB
-
memory/3388-19-0x0000000000D30000-0x0000000000D4A000-memory.dmpFilesize
104KB
-
memory/3388-20-0x00000000006B0000-0x00000000006CA000-memory.dmpFilesize
104KB
-
memory/3388-21-0x0000000000D50000-0x0000000000D70000-memory.dmpFilesize
128KB
-
memory/3388-15-0x0000000000D30000-0x0000000000D4A000-memory.dmpFilesize
104KB
-
memory/4772-26-0x0000000000D40000-0x0000000000D5A000-memory.dmpFilesize
104KB
-
memory/4772-22-0x0000000000D40000-0x0000000000D5A000-memory.dmpFilesize
104KB
-
memory/4772-28-0x0000000000D60000-0x0000000000D80000-memory.dmpFilesize
128KB
-
memory/4772-27-0x00000000004F0000-0x000000000050A000-memory.dmpFilesize
104KB
-
memory/4772-31-0x00000000004F0000-0x000000000050A000-memory.dmpFilesize
104KB