Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 13:34
Static task
static1
Behavioral task
behavioral1
Sample
aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe
-
Size
536KB
-
MD5
aea8cc9ea2da64828259ddad36685f8e
-
SHA1
ca319183736d722a4c5157930e8eba7fb24f3846
-
SHA256
fc762d1673347c40c10454641b6892dc07fea2e0a3564f5cdabcc8764335c5b5
-
SHA512
875254bf1a8265acab4ba84c6973a664130c990b2871d21245fc9113061b74933b251eca46b87678af70324f19514ebe3a2166a03d1eefeb0dcedd596a7f109b
-
SSDEEP
6144:DH/93YEXcP89331OH0j7Ie0+CCiJrOPHbzkXfYTmGaH5KQu2894mST2GG9:b6nE93wU5hCCiAzkXgTsvhq
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exeaea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exeascvoice.exeascvoice.exepid process 5068 aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe 5068 aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe 224 aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe 224 aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe 5008 ascvoice.exe 5008 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe 4036 ascvoice.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exepid process 224 aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exeascvoice.exedescription pid process target process PID 5068 wrote to memory of 224 5068 aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe PID 5068 wrote to memory of 224 5068 aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe PID 5068 wrote to memory of 224 5068 aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe PID 5008 wrote to memory of 4036 5008 ascvoice.exe ascvoice.exe PID 5008 wrote to memory of 4036 5008 ascvoice.exe ascvoice.exe PID 5008 wrote to memory of 4036 5008 ascvoice.exe ascvoice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aea8cc9ea2da64828259ddad36685f8e_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\ascvoice.exe"C:\Windows\SysWOW64\ascvoice.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ascvoice.exe"C:\Windows\SysWOW64\ascvoice.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/224-11-0x00000000020E0000-0x00000000020F6000-memory.dmpFilesize
88KB
-
memory/224-32-0x00000000020C0000-0x00000000020D6000-memory.dmpFilesize
88KB
-
memory/224-7-0x00000000020E0000-0x00000000020F6000-memory.dmpFilesize
88KB
-
memory/224-15-0x00000000020C0000-0x00000000020D6000-memory.dmpFilesize
88KB
-
memory/224-14-0x0000000002100000-0x0000000002110000-memory.dmpFilesize
64KB
-
memory/224-31-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/4036-29-0x0000000000DB0000-0x0000000000DC6000-memory.dmpFilesize
88KB
-
memory/4036-25-0x0000000000DB0000-0x0000000000DC6000-memory.dmpFilesize
88KB
-
memory/5008-17-0x0000000000DA0000-0x0000000000DB6000-memory.dmpFilesize
88KB
-
memory/5008-21-0x0000000000DA0000-0x0000000000DB6000-memory.dmpFilesize
88KB
-
memory/5008-23-0x0000000000DC0000-0x0000000000DD0000-memory.dmpFilesize
64KB
-
memory/5008-22-0x0000000000D80000-0x0000000000D96000-memory.dmpFilesize
88KB
-
memory/5008-30-0x0000000000D80000-0x0000000000D96000-memory.dmpFilesize
88KB
-
memory/5068-12-0x00000000021E0000-0x00000000021F6000-memory.dmpFilesize
88KB
-
memory/5068-5-0x00000000026C0000-0x00000000026D6000-memory.dmpFilesize
88KB
-
memory/5068-13-0x0000000000630000-0x0000000000640000-memory.dmpFilesize
64KB
-
memory/5068-1-0x00000000026C0000-0x00000000026D6000-memory.dmpFilesize
88KB