6e2b1b6b6b88fbcb572a6dd77a270ef2446e6e2c5bfd8e81924e1a2717c0b7f5

Analysis

max time kernel
18s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe
Size

951KB
MD5

ed256bb50496f9021216ccd8d010ced8
SHA1

a24680e1be5b37a97ebc4a9a3ca74a372180ee65
SHA256

6e2b1b6b6b88fbcb572a6dd77a270ef2446e6e2c5bfd8e81924e1a2717c0b7f5
SHA512

250a1143522e976a6e686875e7743c2dea1d562da394c8e3ad6ce1c9d39c4bf1b4837f1fd37c5d9b21d802b7780a9edf81b28ee3af18fff3745e627e46e1bcc1
SSDEEP

12288:AEoD3YWxd7Hd7ZAL/StWJi1zXt9RfqF25/T/10P+ra6tbok5CXZnrBPhseJhLou1:A3UWx59dArkzdxTNXra6tE1thsSLouKO

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2220	ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe
File opened (read-only)	\??\I:	ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe
File opened (read-only)	\??\J:	ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe
File opened (read-only)	\??\K:	ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe
File opened (read-only)	\??\E:	ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe
File opened (read-only)	\??\G:	ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wmdrtc32.dl_	ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wmdrtc32.dll	ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2220	ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed256bb50496f9021216ccd8d010ced8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\wmdrtc32.dll

Filesize
40KB

MD5
03ebc053c8eec6b4f4afbbb5dc64b169

SHA1
9ed172dbce1a6a1dd20e08a9720afba210eee79c

SHA256
ad25714f5c7eb2e27742b5e0886e865fc8884e8b65cb863d2aeba0c6dbff2d02

SHA512
40eab99574ea6614341b869239b014a74cdc24da0c4be69681eaab18de72bbef14ad4cf36215e39eff4978b8ed074762ce25bb85a042219ac5db5cb46390e9ff

Download Submit
memory/2220-0-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2220-7-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2220-9-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/2220-12-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2220-17-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download