Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 14:05
Static task
static1
Behavioral task
behavioral1
Sample
6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe
-
Size
180KB
-
MD5
6b2e8f598b3ea45e75f58a0fbe29def9
-
SHA1
e2aafcb47d53be4442286e55659fd28a17467fb8
-
SHA256
e9b0ae0a043e8f451b2d72ffea650eacbc6e7011e945c290b5fe5e1f71c6f9fc
-
SHA512
e4ece6dc8ba2194a0901531f23608f206223b8aad7468413d5f65f93021c26c1077a91968fbb2662aecbd7baab5468a8f7944f22083c3d0fbdf980d65f6a9882
-
SSDEEP
3072:2n9ENCFkPh0fw+eff2ktl4eqGZNdCkGEaFaB/8Qeko7qLueL+:AqPh0Deffn7qGRvHom+
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exexinputrouter.exexinputrouter.exepid process 3400 6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe 3400 6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe 3128 6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe 3128 6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe 1184 xinputrouter.exe 1184 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe 1252 xinputrouter.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exepid process 3128 6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exexinputrouter.exedescription pid process target process PID 3400 wrote to memory of 3128 3400 6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe 6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe PID 3400 wrote to memory of 3128 3400 6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe 6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe PID 3400 wrote to memory of 3128 3400 6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe 6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe PID 1184 wrote to memory of 1252 1184 xinputrouter.exe xinputrouter.exe PID 1184 wrote to memory of 1252 1184 xinputrouter.exe xinputrouter.exe PID 1184 wrote to memory of 1252 1184 xinputrouter.exe xinputrouter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6b2e8f598b3ea45e75f58a0fbe29def9_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\xinputrouter.exe"C:\Windows\SysWOW64\xinputrouter.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\xinputrouter.exe"C:\Windows\SysWOW64\xinputrouter.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1184-15-0x00000000006D0000-0x00000000006E7000-memory.dmpFilesize
92KB
-
memory/1184-29-0x00000000006B0000-0x00000000006C7000-memory.dmpFilesize
92KB
-
memory/1184-20-0x00000000006B0000-0x00000000006C7000-memory.dmpFilesize
92KB
-
memory/1184-21-0x00000000008F0000-0x0000000000910000-memory.dmpFilesize
128KB
-
memory/1184-19-0x00000000006D0000-0x00000000006E7000-memory.dmpFilesize
92KB
-
memory/1252-27-0x00000000005A0000-0x00000000005B7000-memory.dmpFilesize
92KB
-
memory/1252-28-0x0000000000700000-0x0000000000720000-memory.dmpFilesize
128KB
-
memory/1252-32-0x00000000005A0000-0x00000000005B7000-memory.dmpFilesize
92KB
-
memory/1252-26-0x00000000005C0000-0x00000000005D7000-memory.dmpFilesize
92KB
-
memory/1252-22-0x00000000005C0000-0x00000000005D7000-memory.dmpFilesize
92KB
-
memory/3128-13-0x0000000000700000-0x0000000000720000-memory.dmpFilesize
128KB
-
memory/3128-7-0x00000000006E0000-0x00000000006F7000-memory.dmpFilesize
92KB
-
memory/3128-11-0x00000000006E0000-0x00000000006F7000-memory.dmpFilesize
92KB
-
memory/3128-31-0x00000000005A0000-0x00000000005B7000-memory.dmpFilesize
92KB
-
memory/3128-12-0x00000000005A0000-0x00000000005B7000-memory.dmpFilesize
92KB
-
memory/3128-30-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3400-6-0x0000000000900000-0x0000000000920000-memory.dmpFilesize
128KB
-
memory/3400-1-0x00000000008E0000-0x00000000008F7000-memory.dmpFilesize
92KB
-
memory/3400-4-0x00000000008E0000-0x00000000008F7000-memory.dmpFilesize
92KB
-
memory/3400-5-0x00000000004D0000-0x00000000004E7000-memory.dmpFilesize
92KB
-
memory/3400-14-0x00000000004D0000-0x00000000004E7000-memory.dmpFilesize
92KB