Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 05:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exe
Resource
win7-20240508-en
7 signatures
150 seconds
General
-
Target
0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exe
-
Size
3.9MB
-
MD5
0cd38e18027da4fa19ef7e53155b6995
-
SHA1
d620be0f573e9236f4e20cd8d442af39943059e0
-
SHA256
42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0
-
SHA512
104c660eca8027b508998d66f925eab992a7e8384eee363b765c36de50beedb12fe2f20ef9784dcb2bcabb98da7163bddbe7f420326447569bedaabfbd5924a6
-
SSDEEP
98304:i0NB93Q53yuQaxlCiHqORcwxDAoHa126mUsj:i0g3wWzHDc8DAoHSmUs
Malware Config
Signatures
-
DarkVNC payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1232-8-0x0000000010000000-0x0000000010089000-memory.dmp darkvnc behavioral1/memory/1232-11-0x0000000000580000-0x00000000006C0000-memory.dmp darkvnc -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exedescription pid process target process PID 1232 set thread context of 2516 1232 0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exe WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exepid process 1232 0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exepid process 1232 0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exedescription pid process target process PID 1232 wrote to memory of 2516 1232 0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exe WerFault.exe PID 1232 wrote to memory of 2516 1232 0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exe WerFault.exe PID 1232 wrote to memory of 2516 1232 0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exe WerFault.exe PID 1232 wrote to memory of 2516 1232 0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exe WerFault.exe PID 1232 wrote to memory of 2516 1232 0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exe WerFault.exe PID 1232 wrote to memory of 2516 1232 0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0cd38e18027da4fa19ef7e53155b6995_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1232-0-0x00000000002F0000-0x0000000000329000-memory.dmpFilesize
228KB
-
memory/1232-1-0x0000000000400000-0x00000000007F7000-memory.dmpFilesize
4.0MB
-
memory/1232-5-0x0000000000401000-0x0000000000447000-memory.dmpFilesize
280KB
-
memory/1232-7-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/1232-6-0x0000000002200000-0x0000000002201000-memory.dmpFilesize
4KB
-
memory/1232-8-0x0000000010000000-0x0000000010089000-memory.dmpFilesize
548KB
-
memory/1232-11-0x0000000000580000-0x00000000006C0000-memory.dmpFilesize
1.2MB
-
memory/1232-14-0x0000000000401000-0x0000000000447000-memory.dmpFilesize
280KB
-
memory/1232-13-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2516-12-0x000007FFFFFD8000-0x000007FFFFFD9000-memory.dmpFilesize
4KB