2cb39f2cf8dbff1609dcd8ac1cd31952639399a637c6b3ab0b3999aac06628f2

Analysis

max time kernel
165s
max time network
183s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c89881e8d12c729a25a811069eb9870a_JaffaCakes118.exe
Size

75KB
MD5

c89881e8d12c729a25a811069eb9870a
SHA1

66de95f7271a50e23d60ecbde544f7e7c099ea51
SHA256

2cb39f2cf8dbff1609dcd8ac1cd31952639399a637c6b3ab0b3999aac06628f2
SHA512

93ef2ca07edeebfa225f60d6ca3f045a9c9e68871c913a511040f40cdc3c98a159dfc66a95c0aa8a7ec50f16624e1aaf01722ea527d1c376d9496bc6e67a529f
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuol:vCjsIOtEvwDpj5H9YvQd2K

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2584	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
3040	c89881e8d12c729a25a811069eb9870a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2584	3040	c89881e8d12c729a25a811069eb9870a_JaffaCakes118.exe	27
PID 3040 wrote to memory of 2584	3040	c89881e8d12c729a25a811069eb9870a_JaffaCakes118.exe	27
PID 3040 wrote to memory of 2584	3040	c89881e8d12c729a25a811069eb9870a_JaffaCakes118.exe	27
PID 3040 wrote to memory of 2584	3040	c89881e8d12c729a25a811069eb9870a_JaffaCakes118.exe	27

C:\Users\Admin\AppData\Local\Temp\c89881e8d12c729a25a811069eb9870a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c89881e8d12c729a25a811069eb9870a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
75KB

MD5
d48b74d3f5eddf259ed12120267e65c6

SHA1
69c7a10bd2e8c69f578a21853d15a60d419a1ebf

SHA256
0a3512b85babdc16eb429430edec0fe8f9460f8fae1bd3ad83f016f639117369

SHA512
c45e81d62719699ae8431229e6917d5cbb2dc78695c48d6573248cd78927be914a5c488b938088c5a28214f520f7b0ba7b7cbb03b4c6d15cd6cc5a1ad2b6b647

Download Submit
memory/2584-15-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2584-17-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3040-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/3040-1-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/3040-3-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download