Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 09:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
-
Target
b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe
-
Size
168KB
-
MD5
b7f71db7f2fc9521573a23bbf58aff93
-
SHA1
4cb8185149f7126917b18a668f8c9b2fca87dad1
-
SHA256
ff1537685dcf05b1c30ebf2605a45bea91e9cf7a1aeadefc6dbc707717c2eed1
-
SHA512
7873dad06c3168c540c40458f027f17f5e3278a3a16fba5d9a8f90c40a0b4e1769d4d0b355f90f6a31dd090db5783ece964c3f0b556d3b10ffb93b319032e5ba
-
SSDEEP
3072:NU3EFQStvwaZxP8H1Dt1DO0xFNpYofiSmse/A:fFQcIgx0H5tVx3jqSN7
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exeb7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exelanesstarta.exelanesstarta.exepid process 384 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe 384 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe 1560 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe 1560 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe 2196 lanesstarta.exe 2196 lanesstarta.exe 2284 lanesstarta.exe 2284 lanesstarta.exe 2284 lanesstarta.exe 2284 lanesstarta.exe 2284 lanesstarta.exe 2284 lanesstarta.exe 2284 lanesstarta.exe 2284 lanesstarta.exe 2284 lanesstarta.exe 2284 lanesstarta.exe 2284 lanesstarta.exe 2284 lanesstarta.exe 2284 lanesstarta.exe 2284 lanesstarta.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exepid process 1560 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exelanesstarta.exedescription pid process target process PID 384 wrote to memory of 1560 384 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe PID 384 wrote to memory of 1560 384 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe PID 384 wrote to memory of 1560 384 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe PID 2196 wrote to memory of 2284 2196 lanesstarta.exe lanesstarta.exe PID 2196 wrote to memory of 2284 2196 lanesstarta.exe lanesstarta.exe PID 2196 wrote to memory of 2284 2196 lanesstarta.exe lanesstarta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:1560
-
C:\Windows\SysWOW64\lanesstarta.exe"C:\Windows\SysWOW64\lanesstarta.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\lanesstarta.exe"C:\Windows\SysWOW64\lanesstarta.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2284