Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
14/06/2024, 16:56
General
- Target aac83167081b7d228931845c006253f6_JaffaCakes118.exe
- Size 204KB
- Sample240614-vf5zcssgjr
- SHA256 7efc8446996e148dcf5b6f490899f588c97cd1140b867098943f6a2b486fcc5a
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aac83167081b7d228931845c006253f6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aac83167081b7d228931845c006253f6_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aac83167081b7d228931845c006253f6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aac83167081b7d228931845c006253f6_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
-
C:\Windows\SysWOW64\droidsketch.exe"C:\Windows\SysWOW64\droidsketch.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\droidsketch.exe"C:\Windows\SysWOW64\droidsketch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/760-12-0x0000000000A80000-0x0000000000A96000-memory.dmp
memory/760-8-0x0000000000A80000-0x0000000000A96000-memory.dmp
memory/760-17-0x00000000020C0000-0x00000000020E0000-memory.dmp
memory/760-16-0x0000000000A60000-0x0000000000A76000-memory.dmp
memory/760-15-0x0000000000400000-0x0000000000434000-memory.dmp
memory/760-39-0x0000000000A60000-0x0000000000A76000-memory.dmp
memory/896-0-0x0000000000400000-0x0000000000434000-memory.dmp
memory/896-6-0x0000000002670000-0x0000000002686000-memory.dmp
memory/896-2-0x0000000002670000-0x0000000002686000-memory.dmp
memory/896-14-0x0000000002690000-0x00000000026B0000-memory.dmp
memory/896-13-0x0000000002650000-0x0000000002666000-memory.dmp
memory/896-18-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2452-35-0x00000000009F0000-0x0000000000A10000-memory.dmp
memory/2452-33-0x00000000009D0000-0x00000000009E6000-memory.dmp
memory/2452-29-0x00000000009D0000-0x00000000009E6000-memory.dmp
memory/2452-34-0x00000000009B0000-0x00000000009C6000-memory.dmp
memory/2452-40-0x00000000009B0000-0x00000000009C6000-memory.dmp
memory/3168-21-0x00000000005E0000-0x00000000005F6000-memory.dmp
memory/3168-27-0x0000000000600000-0x0000000000620000-memory.dmp
memory/3168-26-0x00000000005C0000-0x00000000005D6000-memory.dmp
memory/3168-25-0x00000000005E0000-0x00000000005F6000-memory.dmp
memory/3168-36-0x0000000000400000-0x0000000000434000-memory.dmp
memory/3168-37-0x00000000005C0000-0x00000000005D6000-memory.dmp
memory/3168-19-0x0000000000400000-0x0000000000434000-memory.dmp