Analysis
-
max time kernel
144s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe
-
Size
21.1MB
-
MD5
aff24f3d5b86c1a8592b38b609350c54
-
SHA1
3f28f02e948095e8e3f3a2abd3328fbc281ea7b7
-
SHA256
d79db4c19cb70ffec4ac9c75564a51069fea23a8839d3f0267eae20d9ee1f9e4
-
SHA512
dd390400957bad58621f67184924e6bf6764f393121da705c08d7e7b9bf573169b2697dc840dd26b96fc45ded24d687eda6c833e5e68edccd3d24c6d7dc92065
-
SSDEEP
393216:5VjSEPbi7v4SUJIS7kqyOOmUa07h9FI+gB0hLuhu4D3f/s2dXhMEv:zdy4PIS7kHdaiLFGg4D3f/sov
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3036 irsetup.exe -
Loads dropped DLL 5 IoCs
pid Process 2752 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 2752 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 2752 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 2752 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 3036 irsetup.exe -
resource yara_rule behavioral1/files/0x002c000000016812-3.dat upx behavioral1/memory/2752-5-0x0000000002930000-0x0000000002D17000-memory.dmp upx behavioral1/memory/3036-29-0x00000000010B0000-0x0000000001497000-memory.dmp upx behavioral1/memory/3036-33-0x00000000010B0000-0x0000000001497000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3036 irsetup.exe 3036 irsetup.exe 3036 irsetup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2752 wrote to memory of 3036 2752 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 28 PID 2752 wrote to memory of 3036 2752 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 28 PID 2752 wrote to memory of 3036 2752 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 28 PID 2752 wrote to memory of 3036 2752 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 28 PID 2752 wrote to memory of 3036 2752 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 28 PID 2752 wrote to memory of 3036 2752 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 28 PID 2752 wrote to memory of 3036 2752 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1939202 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-39690363-730359138-1046745555-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD59bdcf813d65265255b820bc7a704da3c
SHA1dad6501711992ab874d778ece5a103e143fd42d7
SHA256b15d67b4a57184e5202df3c25e20dc0b7f853f4d527d148b337138900989824a
SHA51253cac68a57194ec33ccc5c212a6b82bc554e85c86faab4e095876f5c037f680c646ce8463857e61438b92cb7ca7c17efea1d713a9d772d9f2afeb5ddd17b6504
-
Filesize
322KB
MD5c3f5f4a1fb69b5889f0bbb313cf6017f
SHA1e4f592cfbd62a3c3caf27177ccea5a77afa649bb
SHA256769416fa7edf38e91a55f4f7163914ee4aad9c8c890ed641c300b73157acac45
SHA512e17d3be36fd2ba892d945f3737ebffdefe6d476224ef3459b567579971559a048a886941f57ae671b3df32844f99575a14c72ef8c49c2d4b1e8352204ccc05ab