Analysis

  • max time kernel
    125s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/06/2024, 13:09

General

  • Target

    0646e2421f3a63c98770c935861d5f40_JaffaCakes118.exe

  • Size

    273KB

  • MD5

    0646e2421f3a63c98770c935861d5f40

  • SHA1

    b647d050bad1ef9aab1d356f161dd084fa4948a3

  • SHA256

    0c7b9568523ef7d404acc23a8de9ef789e772f97809aa5ccda8f6ea9ec8fd2ad

  • SHA512

    a6f82d7388aabe2a80361de844bfb324863d2baf65a9cd2857f993c3a960f36fb3c84a07c83d79d778a220ed258144642667b2d0362747d26a99ba6a0c33e979

  • SSDEEP

    3072:aESJj+qJS6WehSHl9vEpMulJSBoZ4UhUGkeXg8Ab+yqdDCknGyjlvF57OOooo/M4:aE5HZ6SuPZ4XGAbIdHGYvGxtEA

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3424
      • C:\Users\Admin\AppData\Local\Temp\0646e2421f3a63c98770c935861d5f40_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\0646e2421f3a63c98770c935861d5f40_JaffaCakes118.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:116
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:944
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4268,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
      1⤵
        PID:4468

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

        Filesize

        63KB

        MD5

        daf06a1e22703e46893b94147f52c5aa

        SHA1

        54f152e20a2ca5fcbb23419fe4b1a72063cb20c3

        SHA256

        2dca6749a6c8a0fb47b0c8168f5e59077c52d469a765f7371ce2574a197e58e8

        SHA512

        f00fd465a3d464d6c202e7e1b88574bdb325e9df8b717e2146b7e5b9a0c951e3de782a4bea3486bdee40ff473715b02a4aaddc90e856c0760684f072e38dc142

      • memory/116-5-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

        Filesize

        368KB

      • memory/116-14-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

        Filesize

        368KB

      • memory/116-4-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

        Filesize

        368KB

      • memory/116-2-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

        Filesize

        368KB

      • memory/116-8-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

        Filesize

        368KB

      • memory/116-9-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

        Filesize

        368KB

      • memory/116-10-0x0000000001000000-0x000000000102B000-memory.dmp

        Filesize

        172KB

      • memory/116-7-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

        Filesize

        368KB

      • memory/116-6-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

        Filesize

        368KB

      • memory/116-0-0x0000000001000000-0x000000000102B000-memory.dmp

        Filesize

        172KB

      • memory/116-3-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

        Filesize

        368KB

      • memory/116-15-0x0000000001000000-0x000000000102B000-memory.dmp

        Filesize

        172KB

      • memory/116-11-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

        Filesize

        368KB

      • memory/116-1-0x0000000001005000-0x0000000001006000-memory.dmp

        Filesize

        4KB

      • memory/116-30-0x0000000001000000-0x000000000102B000-memory.dmp

        Filesize

        172KB

      • memory/944-20-0x0000000010000000-0x0000000010012000-memory.dmp

        Filesize

        72KB

      • memory/944-28-0x0000000010000000-0x0000000010012000-memory.dmp

        Filesize

        72KB

      • memory/944-27-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/944-19-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/3424-21-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

        Filesize

        4KB

      • memory/3424-23-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

        Filesize

        24KB