23c04a5d95997fb662ceb911a7cdd23a325b01e9fefea9b26171d73fa169414c

Analysis

max time kernel
141s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 23:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.exe
Size 1.6MB
Sample240513-2zn9aahb31
SHA256 23c04a5d95997fb662ceb911a7cdd23a325b01e9fefea9b26171d73fa169414c
MD5 3cede6ad5a3631ef0eb6b9cdc6d83fe2
SHA1 811ee471775b1531d0aede56a7bc959dfc5af663
SHA512 17a87b40533355c5db0599d945bcb0c97dc316d2a19157b919f380b02896a23f75f9938336c29309f8df5fbb70e75bf27365594e25b86bb4c08cc2bd50ae09da
SSDEEP 49152:OCK2Sd9BhTQt69OFvodtW9PQBebA5rOYiZnh:OCK2QktbQdg9oBebSivZnh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1480	3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1480	3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.tmp
1480	3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.tmp
1480	3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.tmp
1480	3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 1480	468	3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.exe	82
PID 468 wrote to memory of 1480	468	3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.exe	82
PID 468 wrote to memory of 1480	468	3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:468
- C:\Users\Admin\AppData\Local\Temp\is-35LI9.tmp\3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-35LI9.tmp\3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.tmp" /SL5="$A01CC,987550,70144,C:\Users\Admin\AppData\Local\Temp\3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-35LI9.tmp\3cede6ad5a3631ef0eb6b9cdc6d83fe2_JaffaCakes118.tmp
Size 1.2MB
SHA256 64e1f1fa7d91920b17bc7bc679a4cd8d87ff5b104318b6921bb6bf6a19055635
MD5 e7106fbf42fbc6d5b08a18ada4f781b4
SHA1 36d4a629f79d772c0b0df8bd2ae2ea09108d239d
SHA512 adf876296a952aadeb4f25211c0939bf5a278809b5d3007ad7e26c5d4975e7684d242c1b3de796efd474a47cb7ecdb80f9047935924a1108bf0e4d7c973d1845
SSDEEP 24576:nmdW7w83t6Wea8u0105qwD7Xw9FiLDuC0vOoVSIgHNnvExCc:nBwZ05qXqdEfgNNQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupcfg.ini

Path C:\Users\Admin\AppData\Local\Temp\is-RR3OB.tmp\setupcfg.ini
Size 44B
SHA256 5869050cf2c623082c806847a590cb9a8b34fb403194b8c05a93fb213412c1ea
MD5 e55fa44eb574b996eeee51d91078008e
SHA1 5eeab6ad55c32c38f54b5e88738ad5148447e33d
SHA512 f90b2da4c23e1da18cdd0848efd3ecdf4c8dd6218a993f6f518b295a50df660ebf17845d75345eeee3bcee7745857db47617b999daec1e2e503291398b9b5945
MD5 SHA1 SHA512

Submit Download

memory/468-0-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/468-2-0x0000000000401000-0x000000000040D000-memory.dmp

Download

memory/468-43-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/1480-7-0x0000000000400000-0x0000000000536000-memory.dmp

Download

memory/1480-44-0x0000000000400000-0x0000000000536000-memory.dmp

Download