bd1b8b62b1d8569689c7b139662a1368a27f42220e9ae40468568d42223bbcb7

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f40009a0e8746ac00a5f39d1043d428c_JaffaCakes118.exe
Size

488KB
MD5

f40009a0e8746ac00a5f39d1043d428c
SHA1

52b3cc4835d30ea5da5d45a84b445247cc500b93
SHA256

bd1b8b62b1d8569689c7b139662a1368a27f42220e9ae40468568d42223bbcb7
SHA512

1064d110fc843494af5805095c0a8db1e04d441ae8ed970265a51f3b37ec5b77c215ea6fd0154c43fe078ffe77e50c59574acf64e301b7c0cfe6e309c325a73a
SSDEEP

6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEwAoARgg2tqPXTy2EMFYwqxpWq0pMWV:FytbV3kSoXaLnToslkf2APfEMy/WvN

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4412	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3016	f40009a0e8746ac00a5f39d1043d428c_JaffaCakes118.exe
3016	f40009a0e8746ac00a5f39d1043d428c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	f40009a0e8746ac00a5f39d1043d428c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 4636	3016	f40009a0e8746ac00a5f39d1043d428c_JaffaCakes118.exe	88
PID 3016 wrote to memory of 4636	3016	f40009a0e8746ac00a5f39d1043d428c_JaffaCakes118.exe	88
PID 4636 wrote to memory of 4412	4636	cmd.exe	90
PID 4636 wrote to memory of 4412	4636	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\f40009a0e8746ac00a5f39d1043d428c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f40009a0e8746ac00a5f39d1043d428c_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\f40009a0e8746ac00a5f39d1043d428c_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads