Analysis
- max time kernel
157s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/06/2024, 15:11
General
- Target 923a0223bcb3e1452ca9b44d692c51b8_JaffaCakes118.exe
- Size 15.4MB
- Sample240603-skv9lsbf77
- SHA256 1859ea9810e150f1110e9da3e34f83f414103e6f1d8df361ef72db88ab54d45c
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\923a0223bcb3e1452ca9b44d692c51b8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\923a0223bcb3e1452ca9b44d692c51b8_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7DS6L.tmp\923a0223bcb3e1452ca9b44d692c51b8_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-7DS6L.tmp\923a0223bcb3e1452ca9b44d692c51b8_JaffaCakes118.tmp" /SL5="$80052,15282287,719872,C:\Users\Admin\AppData\Local\Temp\923a0223bcb3e1452ca9b44d692c51b8_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4028 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
923a0223bcb3e1452ca9b44d692c51b8_JaffaCakes118.tmp
itdownload.dll
memory/3132-13-0x0000000003480000-0x00000000034BC000-memory.dmp
memory/3132-6-0x0000000000400000-0x0000000000678000-memory.dmp
memory/3132-15-0x0000000000400000-0x0000000000678000-memory.dmp
memory/3132-16-0x0000000003480000-0x00000000034BC000-memory.dmp
memory/3132-19-0x0000000003480000-0x00000000034BC000-memory.dmp
memory/3132-22-0x0000000003480000-0x00000000034BC000-memory.dmp
memory/3132-25-0x0000000003480000-0x00000000034BC000-memory.dmp
memory/3132-29-0x0000000000400000-0x0000000000678000-memory.dmp
memory/3132-30-0x0000000003480000-0x00000000034BC000-memory.dmp
memory/3480-7-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/3480-0-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/3480-2-0x0000000000401000-0x00000000004A9000-memory.dmp