Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 01:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe
-
Size
444KB
-
MD5
82b202d58b2e63207ef3dea0b76d102c
-
SHA1
22a100b6db1880807ea7eeb4bd3439769481b0d0
-
SHA256
b66e79babaa49fa58aae643943e97932206e0999effbc9b2a4b2104c817a543e
-
SHA512
09344bd010fa95af11387663fc75ae7aff45ec7f9d964c9342db2fdc4efca997fc7fd171c14f760c1ca8d1d3b8b4024c91ef22e90f26d0d8f19c0b49a04e6330
-
SSDEEP
3072:kDeZmhdv4fO9xUqCvKmefgnaeoRdh6JXHtJPpRI362kNx3:ODv4G9xIvKmkgaHWJXLHI3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3808 82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe 3808 82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe 4300 82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe 4300 82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe 5076 confsensor.exe 5076 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe 4432 confsensor.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4300 82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3808 wrote to memory of 4300 3808 82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe 82 PID 3808 wrote to memory of 4300 3808 82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe 82 PID 3808 wrote to memory of 4300 3808 82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe 82 PID 5076 wrote to memory of 4432 5076 confsensor.exe 93 PID 5076 wrote to memory of 4432 5076 confsensor.exe 93 PID 5076 wrote to memory of 4432 5076 confsensor.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82b202d58b2e63207ef3dea0b76d102c_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:4300
-
-
C:\Windows\SysWOW64\confsensor.exe"C:\Windows\SysWOW64\confsensor.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\confsensor.exe"C:\Windows\SysWOW64\confsensor.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4432
-