Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16-07-2024 07:41
Static task
static1
Behavioral task
behavioral1
Sample
4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe
Resource
win7-20240705-en
8 signatures
150 seconds
General
-
Target
4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe
-
Size
289KB
-
MD5
4d5fab7fea7faedb28daee4bceb224e8
-
SHA1
75647d162f986b5c81e93b057964934d7176aaea
-
SHA256
b4f28e7a94681a99224b3893ccb2845e68e02fde69528dcacb9dc36625827a94
-
SHA512
cef54aced4d56bba316441f91aa83b29e163e42373b13cfcdf6fec499981f3dc2a8cd3a00cf89969d3f1f97fa0e0a3e44a3857c5f0b2cbbe455d7cd1eea79c6e
-
SSDEEP
6144:YRZdbVzesV3nYkM3YdFx7xN3NthPtVrhtt3lhXh/p1rZJjtPQKw0oDOTKl8tqK:YRZT/YLIdFx7xN3NthPtVrhtt3lhXh/X
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1016 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 1016 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 2640 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 2640 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 3944 radarresw.exe 3944 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe 216 radarresw.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2640 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1016 wrote to memory of 2640 1016 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 86 PID 1016 wrote to memory of 2640 1016 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 86 PID 1016 wrote to memory of 2640 1016 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 86 PID 3944 wrote to memory of 216 3944 radarresw.exe 88 PID 3944 wrote to memory of 216 3944 radarresw.exe 88 PID 3944 wrote to memory of 216 3944 radarresw.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2640
-
-
C:\Windows\SysWOW64\radarresw.exe"C:\Windows\SysWOW64\radarresw.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\radarresw.exe"C:\Windows\SysWOW64\radarresw.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:216
-