Analysis

  • max time kernel
    144s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    01/07/2024, 11:24

General

  • Target

    1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe

  • Size

    19KB

  • MD5

    1b1c231de0b26c9c29fe7daf143383a2

  • SHA1

    577e269000b9b3add3d55e13134071978c037c4e

  • SHA256

    bf5d5227318352f2b376464b64e55a6e7d3d4b1dc962fd5533233d457a8fdf66

  • SHA512

    2f0f846ccbb34a032832d05afd7f74acfb9b3905e8787232daf894f5be0119de7ddca49adaccc3dc8d0831b45373400d77fd2b23cd541e98197537748bb857a0

  • SSDEEP

    192:TfHj3tcikMEiZ3fCBq+AAyRyo0+tmDXCGiyfHjwF4Y/JUCDe:lEiZvCBqBAyb0+tmrPs6Y/Jzq

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1b1c231de0b26c9c29fe7daf143383a2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start C:svchost.exe
      2⤵
        PID:2468
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c start C:lsass.exe
        2⤵
          PID:288
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c start C:msnmsgr.exe
          2⤵
            PID:2964

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2420-0-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB

        • memory/2468-29-0x0000000000480000-0x0000000000481000-memory.dmp

          Filesize

          4KB