4c9c7e6c13a25ab5cd9d2969b383e5e22331207c76f14d7e78aef99d46665e44

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

358a760f346f152c9bd0c69053159523_JaffaCakes118.exe
Size

2.0MB
MD5

358a760f346f152c9bd0c69053159523
SHA1

c349eccca58f4a4914a2079aec273606ea4cf721
SHA256

4c9c7e6c13a25ab5cd9d2969b383e5e22331207c76f14d7e78aef99d46665e44
SHA512

e4919669ab9225be9c6f28c5215257f0f9bf9a997e4d12a80d8535da2be2c2021c284e5fc2110ebc1d4aa9df58a0a99475fc4bd6c332a2aba578d14cb04d094a
SSDEEP

49152:EGlJfsKKMvuZqv8BqgrDro+lSV+GP5RHLEgPD7aHYbkXnpx1RIzcF5dlLC:5xKM2ZqvCqYDM+oLjrEg7+HYbkXP1yzh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
900	is-QTSOA.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 900	1988	358a760f346f152c9bd0c69053159523_JaffaCakes118.exe	82
PID 1988 wrote to memory of 900	1988	358a760f346f152c9bd0c69053159523_JaffaCakes118.exe	82
PID 1988 wrote to memory of 900	1988	358a760f346f152c9bd0c69053159523_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\358a760f346f152c9bd0c69053159523_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\358a760f346f152c9bd0c69053159523_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\is-00LK1.tmp\is-QTSOA.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-00LK1.tmp\is-QTSOA.tmp" /SL4 $A011E "C:\Users\Admin\AppData\Local\Temp\358a760f346f152c9bd0c69053159523_JaffaCakes118.exe" 1833138 52736
  2⤵
  - Executes dropped EXE
  PID:900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-00LK1.tmp\is-QTSOA.tmp

Filesize
659KB

MD5
845c81c806359bff78cfdb00c9d96e34

SHA1
0c7c77ba989c8b391c557eb0e482e553dc21ae86

SHA256
6f2df2220fd8e3af982d99e017a7b2412d62319c8d257bfcd0947d40a0696030

SHA512
8c8ae35999a78f684853cd23921da0ed38ffbd4290051ebfcf070a57911e40d2fd38ecd457d4fc84c775430a6963bba6c98a7087186017e13e23bb1e3db89a7d

Download Submit
memory/900-12-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/900-14-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/1988-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1988-2-0x0000000000401000-0x000000000040A000-memory.dmp

Filesize
36KB

Download
memory/1988-13-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download