Analysis
-
max time kernel
144s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 11:24
Static task
static1
Behavioral task
behavioral1
Sample
1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe
-
Size
19KB
-
MD5
1b1c231de0b26c9c29fe7daf143383a2
-
SHA1
577e269000b9b3add3d55e13134071978c037c4e
-
SHA256
bf5d5227318352f2b376464b64e55a6e7d3d4b1dc962fd5533233d457a8fdf66
-
SHA512
2f0f846ccbb34a032832d05afd7f74acfb9b3905e8787232daf894f5be0119de7ddca49adaccc3dc8d0831b45373400d77fd2b23cd541e98197537748bb857a0
-
SSDEEP
192:TfHj3tcikMEiZ3fCBq+AAyRyo0+tmDXCGiyfHjwF4Y/JUCDe:lEiZvCBqBAyb0+tmrPs6Y/Jzq
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2468 2420 1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe 31 PID 2420 wrote to memory of 2468 2420 1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe 31 PID 2420 wrote to memory of 2468 2420 1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe 31 PID 2420 wrote to memory of 2468 2420 1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe 31 PID 2420 wrote to memory of 288 2420 1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe 33 PID 2420 wrote to memory of 288 2420 1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe 33 PID 2420 wrote to memory of 288 2420 1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe 33 PID 2420 wrote to memory of 288 2420 1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe 33 PID 2420 wrote to memory of 2964 2420 1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe 35 PID 2420 wrote to memory of 2964 2420 1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe 35 PID 2420 wrote to memory of 2964 2420 1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe 35 PID 2420 wrote to memory of 2964 2420 1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:svchost.exe2⤵PID:2468
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:lsass.exe2⤵PID:288
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:msnmsgr.exe2⤵PID:2964
-