Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14-07-2024 06:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe
-
Size
27KB
-
MD5
44c2a2c2bbd741b08bfcc10b2630923c
-
SHA1
7e58c1444ec1ff27b30dd14ca6b7315442261fe7
-
SHA256
310b1260bfe180147e5283a21f96381c3e4eb204b122dcfd6f370d00185fbad9
-
SHA512
e1a595480f0c8cfcc42144ec89ab1c0537095c98fca803a1845a7f7b61ee97fda48270f14874a0765e778c0c40d665ea2ac0402e6c4987e21c59e06cca741317
-
SSDEEP
384:H9GryHnJktcBpIwKVuo0C7YfPNarnYCUdPh0pbiWI2Cv:H9EWJ+cH8j4NarnIdPh0pGWm
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\rare = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe" 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1744 smmon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 1744 smmon.exe 1744 smmon.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 636 wrote to memory of 1744 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 84 PID 636 wrote to memory of 1744 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 84 PID 636 wrote to memory of 1744 636 44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\44c2a2c2bbd741b08bfcc10b2630923c_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\smmon.exeC:\Users\Admin\AppData\Local\Temp\smmon.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD53958ad51804cb4184842c685ca3de138
SHA1f54327b7a9c1237e216411640968e2431f5ff5b9
SHA256bccb8a1dee971460048924969c0fd74f3267afad1b051b9d18a588b87df81c94
SHA51243c4f9588d6f46a0eec64e35be908110929cfb4ea9efc448c665ac151ff07131ddcf180a6b76d924d4c800f6e8957c8fcd604badbd9621b8bb3f109622363fa0