Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 00:47
Behavioral task
behavioral1
Sample
04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe
-
Size
1.6MB
-
MD5
04a193d3a8b039a211dc90cd6f35c9cc
-
SHA1
5fdfdd544e307bae8f52b625e98563bf3f1efe31
-
SHA256
59b8581f20e64502990c68044fdea70981b995fa58da96d0bcb05e582bfe6d48
-
SHA512
9ea289bf28435dfb1c82f418cb748cd7f29838da0d2743a9ed4081b1c918b24c73a95c3940fe975bd55059415405cc0d3f05bc2f47caa3dda4d882f1220f2beb
-
SSDEEP
49152:aTa6W7XC6m0RDrvYITpPmQ1uEWzmv7kz4VDEkn2QNX7k8Co:aTa6W7X9m0FTpuQ1uEgmv7ksVDLPk8
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4240 04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2744 4240 WerFault.exe 84 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4240 04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe 4240 04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe 4240 04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe 4240 04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe 4240 04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe 4240 04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4240 04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4240 04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04a193d3a8b039a211dc90cd6f35c9cc_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4240 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 2242⤵
- Program crash
PID:2744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4240 -ip 42401⤵PID:2092