Analysis
- max time kernel
146s - max time network
123s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
- submitted
09/07/2024, 23:21
General
- Target 32675533e481fe16e06e87fa0adff5ae_JaffaCakes118.exe
- Size 392KB
- Sample240709-3ca9ksteqf
- SHA256 d255d3fc62adcce2a08ed6fd088cb9e604fedfb8554b82ccc6a3495f28893abb
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
- Disables taskbar notifications via registry modification
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Windows security modification 2 TTPs 14 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\32675533e481fe16e06e87fa0adff5ae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\32675533e481fe16e06e87fa0adff5ae_JaffaCakes118.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\043A6A5B00014973000C60BAB4EB2331\043A6A5B00014973000C60BAB4EB2331.exe"C:\ProgramData\043A6A5B00014973000C60BAB4EB2331\043A6A5B00014973000C60BAB4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\32675533e481fe16e06e87fa0adff5ae_JaffaCakes118.exe"2⤵
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
043A6A5B00014973000C60BAB4EB2331.exe
memory/2296-22-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2296-46-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2296-42-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2296-41-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2296-40-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2296-28-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2296-21-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2296-18-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2296-16-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2296-23-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2504-0-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2504-7-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2504-27-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2504-5-0x0000000000411000-0x00000000004D2000-memory.dmp
memory/2504-29-0x0000000000411000-0x00000000004D2000-memory.dmp
memory/2504-37-0x0000000000411000-0x00000000004D2000-memory.dmp
memory/2504-36-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2504-2-0x00000000003B0000-0x00000000003B1000-memory.dmp
memory/2504-3-0x0000000000270000-0x0000000000271000-memory.dmp
memory/2504-4-0x0000000000410000-0x00000000004D8000-memory.dmp
memory/2504-6-0x0000000000410000-0x00000000004D8000-memory.dmp