Analysis

  • max time kernel
    80s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2024, 23:05

General

  • Target

    b094b6d7679fccad0a12d922e9dd8856_JaffaCakes118.exe

  • Size

    452KB

  • MD5

    b094b6d7679fccad0a12d922e9dd8856

  • SHA1

    22a0c571c21392a1ea510cfa8a3c10054c2ab9fc

  • SHA256

    10b5685a9f7293e8c828923d6d406c1e246f79cc615e76c19d9a1b9435699cdc

  • SHA512

    25a96bd10354c8a79caad2698c623088d4e44c18dbde513420105fdcd7830d9b73a2a94aef577db9be3308a24e1c6bbf1338488957902ce83f47b21a6d05d819

  • SSDEEP

    6144:VQ4bTT+VtN2juQvvkksCJ/WdXjkN+d1fwLnmNkXUA3BQB3JsRnQB3FSjX8NFO/FZ:ii+jQvvcKkXjODnXUA3F8Rsf

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\b094b6d7679fccad0a12d922e9dd8856_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b094b6d7679fccad0a12d922e9dd8856_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    PID:1316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1316-0-0x0000000000B00000-0x0000000000B02000-memory.dmp

    Filesize

    8KB

  • memory/1316-6-0x00000000010E0000-0x00000000010E1000-memory.dmp

    Filesize

    4KB

  • memory/1316-5-0x00000000010D0000-0x00000000010D1000-memory.dmp

    Filesize

    4KB

  • memory/1316-4-0x00000000010C0000-0x00000000010C1000-memory.dmp

    Filesize

    4KB

  • memory/1316-3-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

    Filesize

    4KB

  • memory/1316-2-0x0000000000B90000-0x0000000000B91000-memory.dmp

    Filesize

    4KB

  • memory/1316-1-0x0000000000B10000-0x0000000000B11000-memory.dmp

    Filesize

    4KB

  • memory/1316-7-0x0000000001140000-0x0000000001141000-memory.dmp

    Filesize

    4KB

  • memory/1316-22-0x0000000001230000-0x0000000001231000-memory.dmp

    Filesize

    4KB

  • memory/1316-23-0x0000000001240000-0x0000000001241000-memory.dmp

    Filesize

    4KB

  • memory/1316-18-0x00000000011D0000-0x00000000011F6000-memory.dmp

    Filesize

    152KB

  • memory/1316-30-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

    Filesize

    4KB

  • memory/1316-29-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

    Filesize

    4KB

  • memory/1316-28-0x0000000001120000-0x0000000001121000-memory.dmp

    Filesize

    4KB

  • memory/1316-27-0x0000000001110000-0x0000000001111000-memory.dmp

    Filesize

    4KB

  • memory/1316-26-0x0000000001100000-0x0000000001101000-memory.dmp

    Filesize

    4KB

  • memory/1316-25-0x00000000010F0000-0x00000000010F1000-memory.dmp

    Filesize

    4KB

  • memory/1316-24-0x0000000001210000-0x0000000001211000-memory.dmp

    Filesize

    4KB

  • memory/1316-17-0x0000000001220000-0x0000000001221000-memory.dmp

    Filesize

    4KB

  • memory/1316-16-0x0000000001130000-0x0000000001132000-memory.dmp

    Filesize

    8KB

  • memory/1316-15-0x0000000001200000-0x0000000001201000-memory.dmp

    Filesize

    4KB

  • memory/1316-14-0x00000000011C0000-0x00000000011C1000-memory.dmp

    Filesize

    4KB

  • memory/1316-13-0x00000000011B0000-0x00000000011B1000-memory.dmp

    Filesize

    4KB

  • memory/1316-12-0x00000000011A0000-0x00000000011A1000-memory.dmp

    Filesize

    4KB

  • memory/1316-11-0x0000000001190000-0x0000000001191000-memory.dmp

    Filesize

    4KB

  • memory/1316-10-0x0000000001180000-0x0000000001181000-memory.dmp

    Filesize

    4KB

  • memory/1316-9-0x0000000001170000-0x0000000001171000-memory.dmp

    Filesize

    4KB

  • memory/1316-8-0x0000000001160000-0x0000000001161000-memory.dmp

    Filesize

    4KB

  • memory/1316-36-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

    Filesize

    4KB