Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2024, 13:32

General

  • Target

    b99d92c81fe8ce5a89d7067ef0c82fff_JaffaCakes118.exe

  • Size

    184KB

  • MD5

    b99d92c81fe8ce5a89d7067ef0c82fff

  • SHA1

    b8e9c1d2edfd02c635f1477f05b039ca451a2649

  • SHA256

    c2e408daa4265defb03ea0ade3382f8b631a1347463125bd91774438389329f1

  • SHA512

    166165024c539eb26d1dc2d0eeeead66bd46987aabe56f9c2b79435a834c56d9fdb62628e337b8347a6d5eb657b70c257cf81daca5d25cf777c868257170b2a5

  • SSDEEP

    3072:hSF0ovjIKvunx+eOVcYxAedDrtq/GHdPXrZTaYEW0EbHajlufA:wuxZPsrtG8PXrEYZ/bmsA

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b99d92c81fe8ce5a89d7067ef0c82fff_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b99d92c81fe8ce5a89d7067ef0c82fff_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops autorun.inf file
    PID:2804

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • F:\dtwoivdj.exe

          Filesize

          184KB

          MD5

          c016a4a857c9ef1f6d426f59a845cca0

          SHA1

          d6a0d32076fd1b9fd637bbadb42887da787f6dd9

          SHA256

          5463f1338766aaf23c7c28616acf4e38e3c65b13c84508bb5ad99283927df072

          SHA512

          913690e777ab1fb639b4445756c289082ca1f1944f6900938fd92c16ac720e91041c066fda242906427fd72c660bb16401f673dc1c9eb4b17b158b78f6ed74af

        • memory/2804-2-0x00000000001A0000-0x00000000001B9000-memory.dmp

          Filesize

          100KB

        • memory/2804-7-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/2804-13-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/2804-26-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/2804-34-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/2804-41-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/2804-47-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/2804-60-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB