b7e3fe7b4a63a80ab2a7ec1f9da98740c723f96c0b423cef4aa4e08ab63047ab

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edc95bf4fb6999f8ee95f9445d3ea6bf_JaffaCakes118.exe
Size

1.2MB
MD5

edc95bf4fb6999f8ee95f9445d3ea6bf
SHA1

31ef3a0eb35ae90deb646303470b955088b6afac
SHA256

b7e3fe7b4a63a80ab2a7ec1f9da98740c723f96c0b423cef4aa4e08ab63047ab
SHA512

4dcab35b9c9e4800bfac755dfef66a2884bbf0735ec9ca595288790520c136693b982274333a57a62c74a051af8e6e0f24b50cb599afc210fad9680cfb26ab56
SSDEEP

24576:Eb5kSYaLTVlj4w2IGmwfMC50zi8IANU2oXt6Ry5PFayDPkwPLj9TY2LvAyuZxM:Eb5k2L5j2bmwf9N8MDXwkNMyDP3jVchM

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4400	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5028	edc95bf4fb6999f8ee95f9445d3ea6bf_JaffaCakes118.exe
5028	edc95bf4fb6999f8ee95f9445d3ea6bf_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	edc95bf4fb6999f8ee95f9445d3ea6bf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1456	5028	edc95bf4fb6999f8ee95f9445d3ea6bf_JaffaCakes118.exe	84
PID 5028 wrote to memory of 1456	5028	edc95bf4fb6999f8ee95f9445d3ea6bf_JaffaCakes118.exe	84
PID 1456 wrote to memory of 4400	1456	cmd.exe	86
PID 1456 wrote to memory of 4400	1456	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\edc95bf4fb6999f8ee95f9445d3ea6bf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\edc95bf4fb6999f8ee95f9445d3ea6bf_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\edc95bf4fb6999f8ee95f9445d3ea6bf_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...