Analysis
-
max time kernel
133s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe
Resource
win7-20240508-en
7 signatures
150 seconds
General
-
Target
8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe
-
Size
132KB
-
MD5
8c7ebd739990c20d34ee9da707747bc2
-
SHA1
f489878f1ea6b00221cb168b749764b5ebb9d364
-
SHA256
75ace839beaa44438502a83dbd2aed5ab8c206700c63a20d1e1425228fc29bf4
-
SHA512
2533fa3fd68e5e31b27d748518004697deed40b8591fcc57edaba6721f21d3cf6175b2c19bc50da7fcf261fb932dee02a1d0105e9749099241bbeb07ebc5b966
-
SSDEEP
3072:LZ/7FQbks58kW7FJBbUBxO7e8wxWLvJAEDO1Al+QQb:LZc5GrZJJUB0e8wyBpa1Ap
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exedsmbundle.exedsmbundle.exepid process 4008 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe 4008 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe 4768 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe 4768 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe 4776 dsmbundle.exe 4776 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe 3708 dsmbundle.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exepid process 4768 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exedsmbundle.exedescription pid process target process PID 4008 wrote to memory of 4768 4008 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe PID 4008 wrote to memory of 4768 4008 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe PID 4008 wrote to memory of 4768 4008 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe PID 4776 wrote to memory of 3708 4776 dsmbundle.exe dsmbundle.exe PID 4776 wrote to memory of 3708 4776 dsmbundle.exe dsmbundle.exe PID 4776 wrote to memory of 3708 4776 dsmbundle.exe dsmbundle.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:4768
-
C:\Windows\SysWOW64\dsmbundle.exe"C:\Windows\SysWOW64\dsmbundle.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\dsmbundle.exe"C:\Windows\SysWOW64\dsmbundle.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3708