Analysis
-
max time kernel
127s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 05:21
Static task
static1
Behavioral task
behavioral1
Sample
0cc2a331b3b2a3327a6a9f8cd8605952_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0cc2a331b3b2a3327a6a9f8cd8605952_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0cc2a331b3b2a3327a6a9f8cd8605952_JaffaCakes118.exe
-
Size
67KB
-
MD5
0cc2a331b3b2a3327a6a9f8cd8605952
-
SHA1
190ed7c20070c651e97bc5eb727d070c87ed14fe
-
SHA256
19bfb77cf0f45782acd545b3d951406c4b173cd23b8f1038567328af2f310732
-
SHA512
885699e515853a2263556b76eb200744bc6d7f28d5c70738b649528abc775ac0ea7a61c5092f7d30dca82cae79b35a9ee2465dc0aa659eeed9f33bf45a4c88b4
-
SSDEEP
1536:1zTChLMZO0g8bHU6E3GEaKpmz0Wjqr0/ki:9TCqHH09aKUQjr0/ki
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\kr_done1 0cc2a331b3b2a3327a6a9f8cd8605952_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3040 0cc2a331b3b2a3327a6a9f8cd8605952_JaffaCakes118.exe 3040 0cc2a331b3b2a3327a6a9f8cd8605952_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3040 wrote to memory of 3220 3040 0cc2a331b3b2a3327a6a9f8cd8605952_JaffaCakes118.exe 93 PID 3040 wrote to memory of 3220 3040 0cc2a331b3b2a3327a6a9f8cd8605952_JaffaCakes118.exe 93 PID 3040 wrote to memory of 3220 3040 0cc2a331b3b2a3327a6a9f8cd8605952_JaffaCakes118.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cc2a331b3b2a3327a6a9f8cd8605952_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0cc2a331b3b2a3327a6a9f8cd8605952_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninste57f85a.bat" "C:\Users\Admin\AppData\Local\Temp\0cc2a331b3b2a3327a6a9f8cd8605952_JaffaCakes118.exe""2⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3852,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:81⤵PID:4504
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59B
MD52988b921fbed03f9c93c5d538932bbe3
SHA14b791b3d59ae76ff091c2cf201b40f5d1b432a3f
SHA256a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3
SHA5122920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9