Analysis
-
max time kernel
131s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 03:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
General
-
Target
70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe
-
Size
672KB
-
MD5
70b98c805dd899ab495c8fc05ed764c5
-
SHA1
d31ac8865116f613474c9c3e94ce2194ba59def3
-
SHA256
1765e8e86cbf4032c41d7a678289637b8ee5d79c4d0a8c42b9c25477af24daec
-
SHA512
bf615f3954371b13ab0e4a561db5e5becb8f8f19c27acc838028a555949d427b76f6fc091dd54ef364027d66e41a0bd7791c9f24a96369f29787ae8349399a0d
-
SSDEEP
6144:udSw4vVxg2WUxHQGDI6NRw4/zJzgwmQ6J:udSJNxg27ZFI6NRNJzBm5J
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exeloaderhexa.exeloaderhexa.exepid process 3608 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe 3608 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe 4696 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe 4696 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe 1720 loaderhexa.exe 1720 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe 4120 loaderhexa.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exepid process 4696 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exeloaderhexa.exedescription pid process target process PID 3608 wrote to memory of 4696 3608 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe PID 3608 wrote to memory of 4696 3608 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe PID 3608 wrote to memory of 4696 3608 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe PID 1720 wrote to memory of 4120 1720 loaderhexa.exe loaderhexa.exe PID 1720 wrote to memory of 4120 1720 loaderhexa.exe loaderhexa.exe PID 1720 wrote to memory of 4120 1720 loaderhexa.exe loaderhexa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:4696
-
C:\Windows\SysWOW64\loaderhexa.exe"C:\Windows\SysWOW64\loaderhexa.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\loaderhexa.exe"C:\Windows\SysWOW64\loaderhexa.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1720-14-0x0000000000670000-0x0000000000687000-memory.dmpFilesize
92KB
-
memory/1720-28-0x0000000000650000-0x0000000000667000-memory.dmpFilesize
92KB
-
memory/1720-19-0x0000000000650000-0x0000000000667000-memory.dmpFilesize
92KB
-
memory/1720-20-0x0000000000610000-0x0000000000620000-memory.dmpFilesize
64KB
-
memory/1720-18-0x0000000000670000-0x0000000000687000-memory.dmpFilesize
92KB
-
memory/3608-0-0x00000000020F0000-0x0000000002107000-memory.dmpFilesize
92KB
-
memory/3608-6-0x0000000002110000-0x0000000002120000-memory.dmpFilesize
64KB
-
memory/3608-5-0x00000000020D0000-0x00000000020E7000-memory.dmpFilesize
92KB
-
memory/3608-4-0x00000000020F0000-0x0000000002107000-memory.dmpFilesize
92KB
-
memory/4120-21-0x0000000000DD0000-0x0000000000DE7000-memory.dmpFilesize
92KB
-
memory/4120-26-0x0000000000D90000-0x0000000000DA7000-memory.dmpFilesize
92KB
-
memory/4120-27-0x0000000000DB0000-0x0000000000DC0000-memory.dmpFilesize
64KB
-
memory/4120-25-0x0000000000DD0000-0x0000000000DE7000-memory.dmpFilesize
92KB
-
memory/4120-31-0x0000000000D90000-0x0000000000DA7000-memory.dmpFilesize
92KB
-
memory/4696-7-0x00000000020F0000-0x0000000002107000-memory.dmpFilesize
92KB
-
memory/4696-11-0x00000000020F0000-0x0000000002107000-memory.dmpFilesize
92KB
-
memory/4696-12-0x00000000020D0000-0x00000000020E7000-memory.dmpFilesize
92KB
-
memory/4696-13-0x0000000002120000-0x0000000002130000-memory.dmpFilesize
64KB
-
memory/4696-30-0x00000000020D0000-0x00000000020E7000-memory.dmpFilesize
92KB
-
memory/4696-29-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB