71c59409068c6dbf0c34189837f81556c8243ce9498971fb988c5832aed937fe

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe
Size

879KB
MD5

5c1729cadc1a8aff93ca2be540e056f6
SHA1

36917324a5b9f675aed2dc047a85974ceb8e8193
SHA256

71c59409068c6dbf0c34189837f81556c8243ce9498971fb988c5832aed937fe
SHA512

31e26ad8145e65c8f3b4f6e8396e5b761ee26da0fe07f243b0792402da65d2cfde33d8c2d7cac852c81622eda34b7ed5a3941e6c8fc86e50184168e4e78e9216
SSDEEP

24576:XUo8O89o+kijjhLM0Od+sbIIex5JhZV/gf/UdYk2:TiiTd+KIIeDJhZ1rG

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
4232	5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe
4232	5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe
4232	5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe
4232	5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe
4232	5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe
4232	5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 1680	4432	5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe	82
PID 4432 wrote to memory of 1680	4432	5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe	82
PID 4432 wrote to memory of 1680	4432	5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe	82
PID 1680 wrote to memory of 4232	1680	5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe	83
PID 1680 wrote to memory of 4232	1680	5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe	83
PID 1680 wrote to memory of 4232	1680	5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Users\Admin\AppData\Local\Temp\5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5c1729cadc1a8aff93ca2be540e056f6_JaffaCakes118.exe"
    3⤵
    - Loads dropped DLL
    - Checks whether UAC is enabled
    PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TnrivkdPzUxYMkh5Y34\1E1l4vKgh.dll

Filesize
74KB

MD5
4c1fdcbf6e855855838dddc33a29bb08

SHA1
39a5a06c2356c6665592d41ec28d51573a7a39c7

SHA256
2db85c57b2379e3d11df84b99112d36648e5479a0ca2ec9b6826390312ba3184

SHA512
7d00f50cc3813540f5691511cc6f4e2198f940b1dcfbdf330645d403f34399dd94bd8f220c56e900b0a4cfce86c2284a4bdc53d837c9b4b49d40557d59b0ac7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TnrivkdPzUxYMkh5Y34\2wE2D18ae0.dll

Filesize
200KB

MD5
dd0eb2d8b565b66adad8b290dd66a4bd

SHA1
7ec5f231b0567a94fdf33a85baa1924b5ff03eb5

SHA256
52e1dc345daed87d34bd7eaf1b73cb7503b8f3cad278911889b8871a6283bb7b

SHA512
03e85cc568da5fcb91dd562654e425bad50913b4e7b0fe01caf95e71bf188b93755b397acee797c595df5e996a829c8041e5cb64481a3cc8cfea31b540b245b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\TnrivkdPzUxYMkh5Y34\lua51.dll

Filesize
494KB

MD5
f0c59526f8186eadaf2171b8fd2967c1

SHA1
8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb

SHA256
6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6

SHA512
dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

Download Submit
C:\Users\Admin\AppData\Local\Temp\TnrivkdPzUxYMkh5Y34\yZvWSsXxcDUukLwXNnrSdEbC90vWFf90iJ.dll

Filesize
5KB

MD5
44dac7f87bdf94d553f8d2cf073d605d

SHA1
21bf5d714b9fcab32ba40ff7d36e48c378b67a06

SHA256
0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66

SHA512
92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

Download Submit
memory/4232-14-0x0000000000690000-0x00000000006C6000-memory.dmp

Filesize
216KB

Download
memory/4232-22-0x000000007FE30000-0x000000007FE40000-memory.dmp

Filesize
64KB

Download
memory/4232-21-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/4232-20-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/4232-26-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/4232-19-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/4232-18-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/4232-17-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/4232-7-0x0000000000540000-0x0000000000557000-memory.dmp

Filesize
92KB

Download