3ccec50b80a73e3ec567c30ed4768ead79fa6f2b037913da351d7acd523a2828

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
Size

1.9MB
MD5

046658187511d7d37e6f1712af2e0529
SHA1

ee32fb23dd8a943bf27339107226138e0e3fe24c
SHA256

3ccec50b80a73e3ec567c30ed4768ead79fa6f2b037913da351d7acd523a2828
SHA512

6804daf5e125cd42b690315df3c7f32b7f8b4ea5a3deb5b8ba6c9e839974d8733121fbd976ed78d856cd213c8760eb859a0a9f7d904a6be3ad27c9a21e93c9d8
SSDEEP

49152:hcMA7xU81kHR6gWakurxp937WHI1xtTqgKXca:hcW7Wo1SgQca

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 6 IoCs

Processes:

046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe

pid	process
1576	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
1576	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
1576	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
1576	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
1576	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
1576	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe

description	pid	process	target process
PID 1904 wrote to memory of 4600	1904	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
PID 1904 wrote to memory of 4600	1904	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
PID 1904 wrote to memory of 4600	1904	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
PID 4600 wrote to memory of 1576	4600	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
PID 4600 wrote to memory of 1576	4600	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
PID 4600 wrote to memory of 1576	4600	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe	046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Local\Temp\046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4600

C:\Users\Admin\AppData\Local\Temp\046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\046658187511d7d37e6f1712af2e0529_JaffaCakes118.exe"
3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1576

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RDWxTKlPHqdaJIa1HZo\1u9QUSrAS.dll
Filesize
74KB

MD5
727216a3430f46b6e4a154784e32cf7f

SHA1
a4424006237bd64bb57ae5867b77883c216e43a2

SHA256
b00fb2d7e9a786ecb46b57ddc8c216135ac296c80844f4a97577d532f7a05a05

SHA512
bc7a3498a3410e10f0d0a6a79b9958cd2e814426dd29ebc9735aa9ac0a0d93102f8d4c84a53314b442065185fd15393373be1f6e689e37fea0e7526fda383608

Download Submit
C:\Users\Admin\AppData\Local\Temp\RDWxTKlPHqdaJIa1HZo\2Vl2TfKFSt.dll
Filesize
200KB

MD5
f81289b5936bebef64a0d143262f6028

SHA1
cf472fd32ec4e9cc0a5f7c70c762764d1d88875a

SHA256
e0d5b71faae38634922fcb488bcc2778c67f7169c02e974c2e6681f27a5c2338

SHA512
82975edee7ce51b662ec6120c647aa4f0998e58ca6a1bf0ede0457e0d5d60023c12a668d8704a1044af3bf30b97d3ae8c1563855fa67de8e18a8ef354e61d355

Download Submit
C:\Users\Admin\AppData\Local\Temp\RDWxTKlPHqdaJIa1HZo\lua51.dll
Filesize
494KB

MD5
f0c59526f8186eadaf2171b8fd2967c1

SHA1
8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb

SHA256
6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6

SHA512
dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

Download Submit
C:\Users\Admin\AppData\Local\Temp\RDWxTKlPHqdaJIa1HZo\yZvWSsXxcDUukLwXNnrSdEbC90vWFf90iJ.dll
Filesize
5KB

MD5
44dac7f87bdf94d553f8d2cf073d605d

SHA1
21bf5d714b9fcab32ba40ff7d36e48c378b67a06

SHA256
0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66

SHA512
92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

Download Submit
memory/1576-25-0x000000007FE30000-0x000000007FE40000-memory.dmp

Filesize
64KB

Download
memory/1576-20-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1576-10-0x0000000002320000-0x0000000002337000-memory.dmp

Filesize
92KB

Download
memory/1576-24-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1576-23-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1576-22-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1576-21-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1576-17-0x0000000002690000-0x00000000026C6000-memory.dmp

Filesize
216KB

Download
memory/1576-2-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/1904-0-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/4600-1-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download