5edf4e8c4509378944cc27ae8c3acbf992311d16a1bfd28ea68decad4478a707

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f8e1ecb4d492cd2b2ea92e3f2b8c8a45_JaffaCakes118.exe
Size

488KB
MD5

f8e1ecb4d492cd2b2ea92e3f2b8c8a45
SHA1

86c107b48bc60855e772e71118edcea7f2c0c853
SHA256

5edf4e8c4509378944cc27ae8c3acbf992311d16a1bfd28ea68decad4478a707
SHA512

0902488177554bca6c8ed891a0d60d58ed21b3a7b8b4d7cbb4b4096297d5706aca1de834161cf6ac3045b3ebc73b1108d977260027992ac636d262af46fb2bcd
SSDEEP

12288:FytbV3kSoXaLnToslv5n0lLtHyFE9iKbp1UPUCInin:Eb5kSYaLTVloLt8E9dXUPUDin

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2876	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4752	f8e1ecb4d492cd2b2ea92e3f2b8c8a45_JaffaCakes118.exe
4752	f8e1ecb4d492cd2b2ea92e3f2b8c8a45_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4752	f8e1ecb4d492cd2b2ea92e3f2b8c8a45_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4148	4752	f8e1ecb4d492cd2b2ea92e3f2b8c8a45_JaffaCakes118.exe	80
PID 4752 wrote to memory of 4148	4752	f8e1ecb4d492cd2b2ea92e3f2b8c8a45_JaffaCakes118.exe	80
PID 4148 wrote to memory of 2876	4148	cmd.exe	82
PID 4148 wrote to memory of 2876	4148	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\f8e1ecb4d492cd2b2ea92e3f2b8c8a45_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8e1ecb4d492cd2b2ea92e3f2b8c8a45_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\f8e1ecb4d492cd2b2ea92e3f2b8c8a45_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads