6360003406c09373d3a55465ac1d82439ce59dcdc68c86dcc53e38ac325dce96

Analysis

max time kernel
82s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8d1e3c590e5421a5dac7a98e9f9c6d2_JaffaCakes118.exe
Size

2.6MB
MD5

f8d1e3c590e5421a5dac7a98e9f9c6d2
SHA1

307044831860a017bb452d8db68123bbe9652d66
SHA256

6360003406c09373d3a55465ac1d82439ce59dcdc68c86dcc53e38ac325dce96
SHA512

adde9d0dd6225bbf3b38eceae81648f1ca2be0a56a6d87200ad629b6049ee368bd6f8b1fe4f9997a2e58d63a11e91ea6e7a94de5236d9edb09759f0e6664164d
SSDEEP

49152:++fqFTqp2ZC6zVmuLlNK9WZWidC8LN5xoGFrjmknX1p1m26MfjEfW898dgy:++f9iC6pmw89WMI7bxoGFrjmknX1p1BB

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2040	other01.exe_tmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Cities at Night Vol.1 Screensaver Uninstaller.exe	f8d1e3c590e5421a5dac7a98e9f9c6d2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2040	1304	f8d1e3c590e5421a5dac7a98e9f9c6d2_JaffaCakes118.exe	86
PID 1304 wrote to memory of 2040	1304	f8d1e3c590e5421a5dac7a98e9f9c6d2_JaffaCakes118.exe	86
PID 1304 wrote to memory of 2040	1304	f8d1e3c590e5421a5dac7a98e9f9c6d2_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\f8d1e3c590e5421a5dac7a98e9f9c6d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8d1e3c590e5421a5dac7a98e9f9c6d2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\Temp\inst240619953\installer\other01.exe_tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\inst240619953\installer\other01.exe_tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\inst240619953\installer\other01.exe_tmp.exe

Filesize
2.1MB

MD5
acff0956f4ea9bddc54070503d1a986e

SHA1
c283b357e793fe38653e605d649a3a7cebfdf3d0

SHA256
5f1c03c78a3dc83930b55487fe976cf662ed2cd3eaa6c1998f751e3b6d4f0e69

SHA512
246b4d3f445aa1886406fe9aefa060b1e46230d7b34f7d669f789adab0dd5b30411256058aa28f1e84d6ce45cce88cae05c83e16ddd6cd1672ee4ee62fffa646

Download Submit