45a849fa4ef1b773b809d545a7f015e4c995ff9799acdab80d77888ebe0d372b

Analysis

max time kernel
127s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe
Size

14KB
MD5

fe5f76685e07fb58437dae6c77b0a830
SHA1

a595c084356960c093de81cc75fa44796c16af5d
SHA256

45a849fa4ef1b773b809d545a7f015e4c995ff9799acdab80d77888ebe0d372b
SHA512

a71af1bab6c0789c54bd25d277be965f1a2b98fd2d9d5f37f8421ea4abfc44e3e2bb5cb0bc71f331b8d549a7d91ceaef2b36c5996e5b22f7780d0211a8ef75dd
SSDEEP

384:WpctE/I+hjbqitkaaCNwkQH4DYUkCcarPML1sK:WpctEQ2qitkUwkQH4DYUkeML

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2468	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\videoPl.chl\CLSID\ = "{6BF52A52-394A-11D3-B153-00C04F79FAA6}"	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\videoPl.chl\CLSID	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\videoPl.chl	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2900	2220	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2900	2220	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2900	2220	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2900	2220	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2468	2220	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2468	2220	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2468	2220	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2468	2220	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\ctfmon.exe
  ctfmon.exe
  2⤵
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\awer0.bat" "
  2⤵
  - Deletes itself
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\awer0.bat

Filesize
302B

MD5
9958174c9177b418d7eb651a96b41354

SHA1
8e0ea441d3f91c040e770aecc73d85e29c3ee45b

SHA256
00afc7fb5451c7f7fdf8118192dff7aadef4928b9adbcdb1f6d7b30726bd00ca

SHA512
6a153e6a9cc6347a2fc502b878b092f63071906090a4ad1df37ab82ee008c7b9a7b5ebda5ea56f752560c3c1faa5eaab035006cf34d960884bee4572eb001f25

Download Submit