Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2024 21:47
Behavioral task
behavioral1
Sample
5933a435cc1e27e6c2de575596638964_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5933a435cc1e27e6c2de575596638964_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5933a435cc1e27e6c2de575596638964_JaffaCakes118.exe
-
Size
104KB
-
MD5
5933a435cc1e27e6c2de575596638964
-
SHA1
b6b62cb96d3b8ce920bb9e4149fe5994abdc549c
-
SHA256
072ee689dea574280bc50fbe1dd64b3fcb6e59426444d8c2adc59ee7cba28846
-
SHA512
9ef14e927d8cd89c16decbafce3ecab123af6bc9bf6720e6230375be7d714ba49cd0a1ad59e9048852b2adb208939588e6a7ec85ab43e02c5767e416971a651d
-
SSDEEP
1536:JD/AwPx+riFFG1l/m3wEeQqjh+rmKVsWiVPsrhSBXUc/:JDBYnFE2jwqWsWMfXn
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3200-0-0x0000000000400000-0x000000000041ABB7-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\F35F4479 = "C:\\Users\\Admin\\AppData\\Roaming\\F35F4479\\bin.exe" winver.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4292 4708 WerFault.exe winver.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
winver.exepid process 4708 winver.exe 4708 winver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3372 Explorer.EXE Token: SeCreatePagefilePrivilege 3372 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 4708 winver.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3372 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5933a435cc1e27e6c2de575596638964_JaffaCakes118.exewinver.exedescription pid process target process PID 3200 wrote to memory of 4708 3200 5933a435cc1e27e6c2de575596638964_JaffaCakes118.exe winver.exe PID 3200 wrote to memory of 4708 3200 5933a435cc1e27e6c2de575596638964_JaffaCakes118.exe winver.exe PID 3200 wrote to memory of 4708 3200 5933a435cc1e27e6c2de575596638964_JaffaCakes118.exe winver.exe PID 3200 wrote to memory of 4708 3200 5933a435cc1e27e6c2de575596638964_JaffaCakes118.exe winver.exe PID 4708 wrote to memory of 3372 4708 winver.exe Explorer.EXE PID 4708 wrote to memory of 2984 4708 winver.exe sihost.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\5933a435cc1e27e6c2de575596638964_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5933a435cc1e27e6c2de575596638964_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 3564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4708 -ip 47081⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2984-17-0x00007FF9E4650000-0x00007FF9E4651000-memory.dmpFilesize
4KB
-
memory/2984-13-0x0000000000F90000-0x0000000000F96000-memory.dmpFilesize
24KB
-
memory/3200-8-0x0000000000400000-0x000000000041ABB7-memory.dmpFilesize
106KB
-
memory/3200-1-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/3200-0-0x0000000000400000-0x000000000041ABB7-memory.dmpFilesize
106KB
-
memory/3200-4-0x00000000025B0000-0x0000000002FB0000-memory.dmpFilesize
10.0MB
-
memory/3200-9-0x00000000025B0000-0x0000000002FB0000-memory.dmpFilesize
10.0MB
-
memory/3372-2-0x00000000008B0000-0x00000000008B6000-memory.dmpFilesize
24KB
-
memory/3372-6-0x00007FF9E44CD000-0x00007FF9E44CE000-memory.dmpFilesize
4KB
-
memory/3372-16-0x00007FF9E4660000-0x00007FF9E4661000-memory.dmpFilesize
4KB
-
memory/3372-3-0x00000000008B0000-0x00000000008B6000-memory.dmpFilesize
24KB
-
memory/4708-7-0x00007FF9E4430000-0x00007FF9E4625000-memory.dmpFilesize
2.0MB
-
memory/4708-5-0x0000000077E72000-0x0000000077E73000-memory.dmpFilesize
4KB
-
memory/4708-11-0x0000000000860000-0x0000000000866000-memory.dmpFilesize
24KB
-
memory/4708-14-0x0000000000860000-0x0000000000866000-memory.dmpFilesize
24KB