17fc9c49de2bbca4154fa686b76604c8959abfbbe08d8534e0937dc142a3ba0b

Analysis

max time kernel
141s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe
Size

1.8MB
MD5

fab07fe70d8bff909875addcb6d6941e
SHA1

61bdcf83229b437f0c7113adf45009a9b3d0a5d8
SHA256

17fc9c49de2bbca4154fa686b76604c8959abfbbe08d8534e0937dc142a3ba0b
SHA512

bab7769ea4bd26caa8c214f5c3ce7a458d536ac6b2bca39284684a14e548c57876405b34eb7fc49da92714223e9616e2bffd090e586bd57b8b1139d7a9a32711
SSDEEP

49152:/DntY25DM1uzOpQxg7V63V3LWMLRZtn6UbWuOXAdv:/B95PZOQF3aMLRrn6mN

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

AnvirSet.exe

pid process

1452 AnvirSet.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1452	AnvirSet.exe

Modifies registry class 3 IoCs

Processes:

AnvirSet.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	AnvirSet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	AnvirSet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	AnvirSet.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe

description	pid	process	target process
PID 4624 wrote to memory of 1452	4624	fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe	AnvirSet.exe
PID 4624 wrote to memory of 1452	4624	fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe	AnvirSet.exe
PID 4624 wrote to memory of 1452	4624	fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe	AnvirSet.exe

C:\Users\Admin\AppData\Local\Temp\fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4624

C:\Users\Admin\AppData\Local\Temp\AnvirSet.exe
"C:\Users\Admin\AppData\Local\Temp\AnvirSet.exe" DeleteSelf
2⤵
- Executes dropped EXE
- Modifies registry class
PID:1452

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AnVirSet.exe
Filesize
1.9MB

MD5
dc7f3631f48bce089576f9b3588e9a61

SHA1
442b69a240354a17bb408acc8d8d050329700122

SHA256
7b853cc236313108f4efd5a9710c09bdc8e36d81fd2b4f059897cfba0ee4d98d

SHA512
b5dbd5f976bee13b0df9d341e5e4cb84c40cb871c36fa97fa9e798a2b815a781590193bbee6cb5255c7f539d98b2a0f6e0a482d3468bb81a1e5e1f98480514a0

Download Submit
memory/1452-12-0x0000000000400000-0x00000000007F2000-memory.dmp

Filesize
3.9MB

Download
memory/1452-13-0x00000000026B0000-0x00000000028F0000-memory.dmp

Filesize
2.2MB

Download
memory/1452-14-0x00000000026B0000-0x00000000026B9000-memory.dmp

Filesize
36KB

Download
memory/1452-16-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download
memory/1452-15-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download
memory/1452-17-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/1452-18-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download
memory/1452-21-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/1452-20-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/1452-19-0x00000000026A0000-0x00000000026A6000-memory.dmp

Filesize
24KB

Download
memory/1452-22-0x00000000024B0000-0x00000000024E5000-memory.dmp

Filesize
212KB

Download
memory/1452-23-0x00000000028D0000-0x00000000028D1000-memory.dmp

Filesize
4KB

Download
memory/1452-24-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Filesize
4KB

Download
memory/1452-25-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1452-26-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Filesize
4KB

Download
memory/1452-27-0x0000000002F90000-0x0000000002F91000-memory.dmp

Filesize
4KB

Download
memory/1452-28-0x0000000004690000-0x0000000004691000-memory.dmp

Filesize
4KB

Download
memory/1452-29-0x00000000046D0000-0x00000000046D1000-memory.dmp

Filesize
4KB

Download
memory/1452-30-0x00000000046F0000-0x00000000046F1000-memory.dmp

Filesize
4KB

Download
memory/1452-31-0x00000000043C0000-0x00000000043C1000-memory.dmp

Filesize
4KB

Download
memory/1452-32-0x0000000000400000-0x00000000007F2000-memory.dmp

Filesize
3.9MB

Download
memory/1452-33-0x00000000026B0000-0x00000000028F0000-memory.dmp

Filesize
2.2MB

Download