Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17-07-2024 06:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
51de2b9486f0b8fc4406ac8956a4da2b_JaffaCakes118.exe
Resource
win7-20240704-en
3 signatures
150 seconds
General
-
Target
51de2b9486f0b8fc4406ac8956a4da2b_JaffaCakes118.exe
-
Size
608KB
-
MD5
51de2b9486f0b8fc4406ac8956a4da2b
-
SHA1
f78be95c8e26a707b927823a0ef6c006e680a22d
-
SHA256
481e617bf801b26b6fb8edc67ea637b1e9db954c0ee673e9a2bce0071768b929
-
SHA512
990a9b4ae0dabccb5d94a917da6034a7b23f22173b2fe2c651227f58a31ed3141f112b8b5c3dc30e1ee341c3db3736b947e84d884e95e3dd1953a9d3f9fd1078
-
SSDEEP
12288:F3Mhue1faMKxXFuK1dCZZ8/Ob6M4gcGrcFyYgWR5:F3RIaxXFuK18Jb6ZSrcs
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
51de2b9486f0b8fc4406ac8956a4da2b_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" 51de2b9486f0b8fc4406ac8956a4da2b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
51de2b9486f0b8fc4406ac8956a4da2b_JaffaCakes118.exedescription pid process target process PID 2476 wrote to memory of 2140 2476 51de2b9486f0b8fc4406ac8956a4da2b_JaffaCakes118.exe dw20.exe PID 2476 wrote to memory of 2140 2476 51de2b9486f0b8fc4406ac8956a4da2b_JaffaCakes118.exe dw20.exe PID 2476 wrote to memory of 2140 2476 51de2b9486f0b8fc4406ac8956a4da2b_JaffaCakes118.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51de2b9486f0b8fc4406ac8956a4da2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\51de2b9486f0b8fc4406ac8956a4da2b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 9482⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2140-6-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/2476-0-0x000007FEF505E000-0x000007FEF505F000-memory.dmpFilesize
4KB
-
memory/2476-1-0x000007FEF4DA0000-0x000007FEF573D000-memory.dmpFilesize
9.6MB
-
memory/2476-2-0x0000000002340000-0x00000000023C0000-memory.dmpFilesize
512KB
-
memory/2476-3-0x000007FEF4DA0000-0x000007FEF573D000-memory.dmpFilesize
9.6MB
-
memory/2476-7-0x000007FEF4DA0000-0x000007FEF573D000-memory.dmpFilesize
9.6MB