Analysis
- max time kernel
144s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
13/06/2024, 05:48
General
- Target a40fc01efbb70bace26239e3989c86a3_JaffaCakes118.exe
- Size 6.2MB
- Sample240613-ghxtwawerd
- SHA256 7c3e9a2cc1ba09877cb696375d73974aa666a3280f218553bfd910fd13b5d065
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops file in Program Files directory 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 11 IoCs
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a40fc01efbb70bace26239e3989c86a3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a40fc01efbb70bace26239e3989c86a3_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6VA8K.tmp\a40fc01efbb70bace26239e3989c86a3_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-6VA8K.tmp\a40fc01efbb70bace26239e3989c86a3_JaffaCakes118.tmp" /SL5="$B004C,4866433,914432,C:\Users\Admin\AppData\Local\Temp\a40fc01efbb70bace26239e3989c86a3_JaffaCakes118.exe"2⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
a40fc01efbb70bace26239e3989c86a3_JaffaCakes118.tmp
CallbackCtrl.dll
InnoCallback.dll
NetworkSupport.dll
VclStylesinno.dll
b2p.dll
botva2.dll
layered.dll
win_toast_helper.dll
memory/1876-48-0x00000000061A0000-0x00000000061A1000-memory.dmp
memory/1876-41-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-84-0x0000000006260000-0x0000000006261000-memory.dmp
memory/1876-83-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-82-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-81-0x0000000006250000-0x0000000006251000-memory.dmp
memory/1876-79-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-75-0x0000000006230000-0x0000000006231000-memory.dmp
memory/1876-74-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-40-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-72-0x0000000006220000-0x0000000006221000-memory.dmp
memory/1876-71-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-70-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-69-0x0000000006210000-0x0000000006211000-memory.dmp
memory/1876-65-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-64-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-63-0x00000000061F0000-0x00000000061F1000-memory.dmp
memory/1876-62-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-61-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-60-0x00000000061E0000-0x00000000061E1000-memory.dmp
memory/1876-59-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-58-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-57-0x00000000061D0000-0x00000000061D1000-memory.dmp
memory/1876-56-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-55-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-54-0x00000000061C0000-0x00000000061C1000-memory.dmp
memory/1876-53-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-52-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-51-0x00000000061B0000-0x00000000061B1000-memory.dmp
memory/1876-50-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-49-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-38-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-46-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-45-0x0000000006190000-0x0000000006191000-memory.dmp
memory/1876-44-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-43-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-47-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-42-0x0000000003710000-0x0000000003711000-memory.dmp
memory/1876-73-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-39-0x0000000003700000-0x0000000003701000-memory.dmp
memory/1876-80-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-78-0x0000000006240000-0x0000000006241000-memory.dmp
memory/1876-77-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-76-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-35-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-68-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-66-0x0000000006200000-0x0000000006201000-memory.dmp
memory/1876-67-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-37-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-36-0x00000000036F0000-0x00000000036F1000-memory.dmp
memory/1876-33-0x00000000036E0000-0x00000000036E1000-memory.dmp
memory/1876-32-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-30-0x00000000036D0000-0x00000000036D1000-memory.dmp
memory/1876-29-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-34-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-28-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-26-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-25-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-27-0x00000000036C0000-0x00000000036C1000-memory.dmp
memory/1876-31-0x0000000005F50000-0x0000000006090000-memory.dmp
memory/1876-152-0x0000000000400000-0x0000000000744000-memory.dmp
memory/1876-153-0x0000000000400000-0x0000000000744000-memory.dmp
memory/1876-154-0x0000000000400000-0x0000000000744000-memory.dmp
memory/1876-24-0x00000000036B0000-0x00000000036B1000-memory.dmp
memory/1876-21-0x0000000005BF0000-0x0000000005F42000-memory.dmp
memory/1876-167-0x0000000074300000-0x0000000074311000-memory.dmp
memory/1876-166-0x0000000000400000-0x0000000000744000-memory.dmp
memory/1876-168-0x0000000000400000-0x0000000000744000-memory.dmp
memory/1876-7-0x0000000000400000-0x0000000000744000-memory.dmp
memory/1876-172-0x0000000000400000-0x0000000000744000-memory.dmp
memory/1876-189-0x0000000000400000-0x0000000000744000-memory.dmp
memory/4480-0-0x0000000000400000-0x00000000004EB000-memory.dmp
memory/4480-1-0x0000000000401000-0x0000000000424000-memory.dmp