Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 06:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a43517daccdad5d036434fa0cb36b5a0_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
a43517daccdad5d036434fa0cb36b5a0_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target a43517daccdad5d036434fa0cb36b5a0_JaffaCakes118.exe
- Size 60KB
- Sample240613-g9knmaxdra
- SHA256 95961b8f5d59930b6e867f09c19e0b18a06445ce4d1bb8359d59ffbf0d01021c
- MD5 a43517daccdad5d036434fa0cb36b5a0
- SHA1 d8e43fbc599ceae39122b26851232d09658119a8
- SHA512 64bd00a98e24b264fbf12055fe51bb051734ecaedba1fd25434a8dd949dab0755b9405e87399ff6e2f02597f0236f0c190d251cbc3c5c5d4f74445a568c0860c
- SSDEEP 768:XAaDt+5D+wDmpnIy9NdfbVpWsyqAggqFU84Qt/QAcQVu84Qt/QA:Qqt2+wDmtlusyqFgWJtoApJtoA
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4012 updatede303.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\54rk = "C:\\Windows\\SysWOW64\\updatede303.exe" updatede303.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cfghw.tmp a43517daccdad5d036434fa0cb36b5a0_JaffaCakes118.exe File created C:\Windows\SysWOW64\updatede303.exe a43517daccdad5d036434fa0cb36b5a0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cfghw.tmp updatede303.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe 4012 updatede303.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4676 wrote to memory of 4012 4676 a43517daccdad5d036434fa0cb36b5a0_JaffaCakes118.exe 82 PID 4676 wrote to memory of 4012 4676 a43517daccdad5d036434fa0cb36b5a0_JaffaCakes118.exe 82 PID 4676 wrote to memory of 4012 4676 a43517daccdad5d036434fa0cb36b5a0_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\a43517daccdad5d036434fa0cb36b5a0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a43517daccdad5d036434fa0cb36b5a0_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\updatede303.exeC:\Windows\system32\updatede303.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\cfghw.tmp
- Size 361B
- SHA256 131d6c04a3295c49b694aace549c433dfe0610e376c54c1c43267e9ed47317b1
- MD5 fed513e713a3a892ff3daf9235fb67bd
- SHA1 e6a48e3a676cc24160e76c1292151ced7c545110
- SHA512 c1dfae49d5a90a265f798345518704eeda7f7ecff6d11bdad5f3fcd96568ec9c7ab7ed15f282f6a5ad04b57022d489572bd0fa551517f8a5af9d0d658fedc6cd
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\cfghw.tmp
- Size 466B
- SHA256 aba6b251b738d6b1f2f85917fa15808d0018ccb9e613da3d1f30965844e5777e
- MD5 d7f3754acb5258c754d6407d2924bde3
- SHA1 b1c195764ba742688ac62bdc18168e7dc5f99deb
- SHA512 f8390eb5add5727f8cd683332284ba3040a387939ab75ccab472e07701b0117005825f352ee0f34b5aba33f1ce8ae2702db9c5946caf2faf826a399f0ef38a94
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\updatede303.exe
- Size 39KB
- SHA256 293e7051a6160af58189b1128799edae1578ae9b9ae842e35b640179d9061a0e
- MD5 cdc555406c7ceacc5782eec02d44bb5a
- SHA1 297908f62efb34be6b24c3cb2982149d76e5ce69
- SHA512 10617c7089301f9548880f7be0f47124457cf5c6ab0c647a812e9055b8469abb40c5b559e055fc5076ebe795f216a5f7879354954435f720a57d06b849d69b79
- SSDEEP 384:ZT/he8zdTyBsyqAIZhgqFgyTwR2IKDLexQcRahx3mOSlZ2GGgFQPIOdYD4wR2IKp:ZpWsyqAggqFU84Qt/QAcQVu84Qt/QA
- MD5 SHA1 SHA512 SSDEEP