cb147546c928a60d504152b525998f439b3bdb39d77e7772f3b9ff2e60011f3e

Analysis

max time kernel
93s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8cc2d9b5f578d667e721cc96fffd308_JaffaCakes118.exe
Size

316KB
MD5

e8cc2d9b5f578d667e721cc96fffd308
SHA1

135443ccd69fe9529e3066de67a447014566aada
SHA256

cb147546c928a60d504152b525998f439b3bdb39d77e7772f3b9ff2e60011f3e
SHA512

48c73b6b291cc7901725611b63628ebb167b1bf23ab12a66aa2f2f60bd746e2fc840ba14234507f7b2a530dd8be4e74fdb6446c7b85a7cdf7a6bccb78340b679
SSDEEP

6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiE5SnUW7YTcw:FytbV3kSoXaLnTosloIUW0r

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2780	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3264	e8cc2d9b5f578d667e721cc96fffd308_JaffaCakes118.exe
3264	e8cc2d9b5f578d667e721cc96fffd308_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3264	e8cc2d9b5f578d667e721cc96fffd308_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2952	3264	e8cc2d9b5f578d667e721cc96fffd308_JaffaCakes118.exe	84
PID 3264 wrote to memory of 2952	3264	e8cc2d9b5f578d667e721cc96fffd308_JaffaCakes118.exe	84
PID 2952 wrote to memory of 2780	2952	cmd.exe	86
PID 2952 wrote to memory of 2780	2952	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\e8cc2d9b5f578d667e721cc96fffd308_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8cc2d9b5f578d667e721cc96fffd308_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\e8cc2d9b5f578d667e721cc96fffd308_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...