Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 08:28

General

  • Target

    e012e871a15695612515d1578be49d83_JaffaCakes118.exe

  • Size

    141KB

  • MD5

    e012e871a15695612515d1578be49d83

  • SHA1

    e8b4c6632a133df46713296ca21e87d3f6159107

  • SHA256

    ea7d9e9b846e07ee0e1fbfde3d125cc51ee11b4a361cdae630738f59f8acd2c6

  • SHA512

    9b1f0858a26055744dff806ca7d266796bf050765cc969b81ca4e81acd914bf67bf6c5f7b4313860dc7c7f33a1b9450afddb30f217d716f4e6f45fe8b4c91800

  • SSDEEP

    3072:HsG9XkkFluFTgs5ZfwUVEac1fAGxyVhUZS/ojwx90ZbZAQ:rkgXs5ZIUaac1YPEZSw0x9mZ

Score
10/10

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\e012e871a15695612515d1578be49d83_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e012e871a15695612515d1578be49d83_JaffaCakes118.exe"
    1⤵
      PID:3496

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\malmustafa

      Filesize

      45KB

      MD5

      60fb86cc7b5b521e5a63d31e503df61a

      SHA1

      1c7d52533038a25c690561844657b92ab2817de5

      SHA256

      8d098354ee9c5d508db21549519c3ef87b07e96fba92e62035f9f60874974e19

      SHA512

      1508e87931c0c8d89aef0b2e7db3baa6d6b614e5c1a6012f8e4802d069060022cce3e5a25b049ba39a604d3695a7ce425fa5f5777a3956549ddb7e51a70f385e

    • memory/3496-0-0x0000000000880000-0x00000000008A8000-memory.dmp

      Filesize

      160KB

    • memory/3496-1-0x00007FFF99D20000-0x00007FFF9A7E1000-memory.dmp

      Filesize

      10.8MB

    • memory/3496-2-0x0000000001310000-0x0000000001324000-memory.dmp

      Filesize

      80KB

    • memory/3496-30-0x00007FFF99D20000-0x00007FFF9A7E1000-memory.dmp

      Filesize

      10.8MB