Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 12:50
Static task
static1
Behavioral task
behavioral1
Sample
ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe
-
Size
1008KB
-
MD5
ae816597f9990952c8b6f523b64f24c9
-
SHA1
f6a8209eebb95669f4c1223d4abe02888bf54173
-
SHA256
98605f399585016ae41edcfbc496fa98225ad51928b26b9dff6261fbc09d7d7f
-
SHA512
0847a636793b165dc30e3269ecda30371d26700ab213f34432912662f32431d1be1a6c811184a68aa6b3455ba392285524e7366695b3db642cc7f897da03c0bc
-
SSDEEP
12288:jcZsEIkKatBE0nv8Po4GxxlZsEIkKatBE0nv8Po4Gxx1ko:AZZIkbBTEQ4UZZIkbBTEQ4Po
Malware Config
Extracted
formbook
4.1
k8b
happycampersevents.com
sdjlhbsbgc.com
stephenkapere.com
iammelissamay.com
westhillsterracepdx.com
exceptionalhospitals.com
newnongye.com
sfheli.com
ytalmorales.com
etkensigorta.com
trophemus-treasure-hunters.com
ppcreselleraccount.com
prelovedfashiontreasures.com
santrixpharma.com
ahwxshop.com
7sat.asia
pitadippers.com
citestaccnt1598634983.com
testcaresort.com
supportcorder.com
tataaiawellnessday.com
dekacoiffure.com
sasvisioninternational.com
theresegabriel.com
igraigrica.com
pbuckleyprojects.com
wintersmooncandleco.com
messi-and-ronaldo.com
localille.com
colunadeterca.info
joesellspa.com
mymvttbenefits.com
therbalfoodinv.com
roganjoshi.net
hoodiesandties.com
bearded.photography
torresmetalicas.com
slippefisc.com
thedifystudios.com
a17-os.com
1915dobbindr.com
ssmgaezp.icu
zhuce580.com
donotwaitmore.com
karunadupa.com
actamilbc.com
khalong.xyz
pricetagpulse.com
ibslns.com
fit-for-diving.com
bestweedeaterguides.net
afaalgen.com
escuelainteligente.com
cleanroomtelephone.com
pardisebrahimi.com
dagvauditoresconsultores.com
cordiumjewelry.com
10andrews.com
san-andreas.online
ssgasiaw.com
thicongmaitonhanoi.asia
liveeditionproductions.com
goodjointmobilecuts.com
illupified.com
glowtey.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2528-13-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exedescription pid process target process PID 1672 set thread context of 2528 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exeae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exepid process 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe 2528 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exedescription pid process target process PID 1672 wrote to memory of 2524 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe schtasks.exe PID 1672 wrote to memory of 2524 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe schtasks.exe PID 1672 wrote to memory of 2524 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe schtasks.exe PID 1672 wrote to memory of 2524 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe schtasks.exe PID 1672 wrote to memory of 2528 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe PID 1672 wrote to memory of 2528 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe PID 1672 wrote to memory of 2528 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe PID 1672 wrote to memory of 2528 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe PID 1672 wrote to memory of 2528 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe PID 1672 wrote to memory of 2528 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe PID 1672 wrote to memory of 2528 1672 ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pRVJhcAjvJZLI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF1E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ae816597f9990952c8b6f523b64f24c9_JaffaCakes118.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF1E.tmpFilesize
1KB
MD5a766853eab7c400c9a7ae7d95518199f
SHA19cf822a57320b80388743718fca51e26b4b30a45
SHA256374a223dd2726965614d4a8fc70629f91a9a2a8304631fe6c96835b152dbe94d
SHA512c4a0ef1e291b89499bd1994f8ef94272d82463a9132b5949130483a742753045e759ff25d193397e4841a125b6b1824fc983b05c98ce2c1651503b0f2bfb1b0a
-
memory/1672-0-0x00000000743F1000-0x00000000743F2000-memory.dmpFilesize
4KB
-
memory/1672-1-0x00000000743F0000-0x000000007499B000-memory.dmpFilesize
5.7MB
-
memory/1672-2-0x00000000743F0000-0x000000007499B000-memory.dmpFilesize
5.7MB
-
memory/1672-3-0x00000000743F0000-0x000000007499B000-memory.dmpFilesize
5.7MB
-
memory/1672-14-0x00000000743F0000-0x000000007499B000-memory.dmpFilesize
5.7MB
-
memory/2528-8-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2528-9-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2528-13-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2528-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2528-15-0x0000000000AF0000-0x0000000000DF3000-memory.dmpFilesize
3.0MB