Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 21:33
Static task
static1
Behavioral task
behavioral1
Sample
b0321e5472b660e88475150a08046f96_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
b0321e5472b660e88475150a08046f96_JaffaCakes118.exe
-
Size
136KB
-
MD5
b0321e5472b660e88475150a08046f96
-
SHA1
908ad051057181f5dc7ec9612566d1f91df6f8c9
-
SHA256
4351997cac5515c936f357f7d0954e54774c62ecdb46f959ca6af1245a711f0e
-
SHA512
a72cc235229180285ae4f1697cb53d24a55cb5bcbae697e7ae87206623c8e00b143fcae60cd2f48c23c4b8c6342d6e3979a88c3a8b53ae912eb3e1fcf6812339
-
SSDEEP
1536:hgtaukjjOHZpVga9BJbLQheoMEwgiP8Rp+StQRex6+1fJKHtYmXCa:hgyjSVgaKcoTwR0LaRe8+1fJKH26
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
b0321e5472b660e88475150a08046f96_JaffaCakes118.exeb0321e5472b660e88475150a08046f96_JaffaCakes118.exerunningiface.exerunningiface.exepid process 4184 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe 4184 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe 3628 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe 3628 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe 440 runningiface.exe 440 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe 2412 runningiface.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
b0321e5472b660e88475150a08046f96_JaffaCakes118.exepid process 3628 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b0321e5472b660e88475150a08046f96_JaffaCakes118.exerunningiface.exedescription pid process target process PID 4184 wrote to memory of 3628 4184 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe b0321e5472b660e88475150a08046f96_JaffaCakes118.exe PID 4184 wrote to memory of 3628 4184 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe b0321e5472b660e88475150a08046f96_JaffaCakes118.exe PID 4184 wrote to memory of 3628 4184 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe b0321e5472b660e88475150a08046f96_JaffaCakes118.exe PID 440 wrote to memory of 2412 440 runningiface.exe runningiface.exe PID 440 wrote to memory of 2412 440 runningiface.exe runningiface.exe PID 440 wrote to memory of 2412 440 runningiface.exe runningiface.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0321e5472b660e88475150a08046f96_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b0321e5472b660e88475150a08046f96_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b0321e5472b660e88475150a08046f96_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b0321e5472b660e88475150a08046f96_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\runningiface.exe"C:\Windows\SysWOW64\runningiface.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\runningiface.exe"C:\Windows\SysWOW64\runningiface.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/440-12-0x00000000008D0000-0x00000000008E7000-memory.dmpFilesize
92KB
-
memory/440-22-0x00000000008B0000-0x00000000008C7000-memory.dmpFilesize
92KB
-
memory/440-16-0x00000000008B0000-0x00000000008C7000-memory.dmpFilesize
92KB
-
memory/440-17-0x0000000000D70000-0x0000000000D88000-memory.dmpFilesize
96KB
-
memory/2412-23-0x00000000005F0000-0x0000000000607000-memory.dmpFilesize
92KB
-
memory/2412-18-0x0000000000610000-0x0000000000627000-memory.dmpFilesize
92KB
-
memory/2412-24-0x0000000000630000-0x0000000000648000-memory.dmpFilesize
96KB
-
memory/2412-27-0x00000000005F0000-0x0000000000607000-memory.dmpFilesize
92KB
-
memory/3628-10-0x00000000005C0000-0x00000000005D7000-memory.dmpFilesize
92KB
-
memory/3628-11-0x0000000000720000-0x0000000000738000-memory.dmpFilesize
96KB
-
memory/3628-6-0x0000000000700000-0x0000000000717000-memory.dmpFilesize
92KB
-
memory/3628-25-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3628-26-0x00000000005C0000-0x00000000005D7000-memory.dmpFilesize
92KB
-
memory/4184-5-0x00000000021F0000-0x0000000002208000-memory.dmpFilesize
96KB
-
memory/4184-4-0x00000000021B0000-0x00000000021C7000-memory.dmpFilesize
92KB
-
memory/4184-0-0x00000000021D0000-0x00000000021E7000-memory.dmpFilesize
92KB