20920974de79ee2630de6c7b6399fe71a956f5503da25b1021ec6d1f586c4108

Analysis

max time kernel
144s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

314d29c72a72b97d49d77defa8587103_JaffaCakes118.exe
Size

385KB
MD5

314d29c72a72b97d49d77defa8587103
SHA1

0fe98c940097fe16c94b8dde550049a60ae6c3b9
SHA256

20920974de79ee2630de6c7b6399fe71a956f5503da25b1021ec6d1f586c4108
SHA512

3a83a1fc5a6be082d69b2ebfc359c262606c894ee699f4c326de107823b653b45b06e49e35cab81c082512ab8529f0761bd583706ca023fe14f11de89d6c4233
SSDEEP

6144:IhaIawBGOUXd/YEjt836elPnxX7ZEgzauEKEpHGxnCGH:VSTUXdgE666PN7Ja7KEd2CGH

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4800	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3988	2648	314d29c72a72b97d49d77defa8587103_JaffaCakes118.exe	91
PID 2648 wrote to memory of 3988	2648	314d29c72a72b97d49d77defa8587103_JaffaCakes118.exe	91
PID 2648 wrote to memory of 3988	2648	314d29c72a72b97d49d77defa8587103_JaffaCakes118.exe	91
PID 3988 wrote to memory of 4800	3988	cmd.exe	93
PID 3988 wrote to memory of 4800	3988	cmd.exe	93
PID 3988 wrote to memory of 4800	3988	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\314d29c72a72b97d49d77defa8587103_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\314d29c72a72b97d49d77defa8587103_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\314d29c72a72b97d49d77defa8587103_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2648-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2648-1-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2648-2-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2648-3-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2648-4-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download