a457c012e32f46fc1eae242cbb76da1db2495bc6264c9e63243436b17d7d04f7

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
Size

47KB
MD5

5cac2210bcbcc1988500585e231478de
SHA1

d6381bac966efe6c40c984f51ed6c4195ac88e35
SHA256

a457c012e32f46fc1eae242cbb76da1db2495bc6264c9e63243436b17d7d04f7
SHA512

110e0999c58a3c27b5014fad19dca66f380323199abe7ececee21949e9eff5b7550b19a460ac4de55626faa7d2c6b7a447ec6d3b4bfe21de5a8ff083f99c0e63
SSDEEP

768:vwui4LW5uW2MURAP7DQRVSSu1A6LQ/JvudCKX6IML0i:xihuW2bXPSSehLQ/t2qIk0i

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\E:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\I:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\N:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\S:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\T:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\U:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\B:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\K:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\W:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\Z:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\H:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\L:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\M:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\O:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\P:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\Q:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\A:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\G:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\J:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\R:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\V:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened (read-only)	\??\X:	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\setupcln\diagwrn.xml	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\setupact.log	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\setuperr.log	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\diagerr.xml	5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5cac2210bcbcc1988500585e231478de_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\LogFiles\setupcln\diagerr.xml

Filesize
9KB

MD5
a96fa74abc961b04fc8b11d36fcf7335

SHA1
54078e870ee2be84ab71354d5b671d6e468fe7ea

SHA256
d8387eb6d7be7bf120ad249d0b9e6e78bfdd283b6d1318622394952c5e19eaf9

SHA512
bcc8d558be3d19cf3a24a7e246c4b8a800bb228df4e60c7d53104d633e4853ff1f60da4d6f7d2f0487ff7b4faff49fca56e4e4dbe24b3fd728599b75f466d6c2

Download Submit
C:\Windows\System32\LogFiles\setupcln\diagwrn.xml

Filesize
9KB

MD5
ef82b304067edcf3cf990a42de93b695

SHA1
a2a2af4015e81562bab4454232bbcb69708f5cd9

SHA256
63a505045b1d4549428a469bf00b0f83aaf58cfd9eb2c32b24f17336e323ab31

SHA512
8f5e17ed20bd033370220c7dc9f1373cd9aa79d3fe3b73cef1dbf0134f8705997f1287427c03d87e16a5932855a553501988b3c43b4ca2329d4d8f153dbe5d41

Download Submit
C:\Windows\System32\LogFiles\setupcln\setupact.log

Filesize
11KB

MD5
449e8507620706ca7df28e18836025ec

SHA1
f998e0dad63a1aaefa676614baa6eadc770695af

SHA256
1bab460a8b1421ca560c74625a0dd3ceaef248f55f479f3b2724dd7ba8c9e4c0

SHA512
10676f59acc21b987769422fc9134438a1a4e6be6c9db2599428c450fa6c50a8c4931037563be391675d2d1c65b95ce624baf04f67bd5c811c7c723d1a30a492

Download Submit
memory/2360-0-0x0000000001000000-0x000000000101B000-memory.dmp

Filesize
108KB

Download
memory/2360-35-0x0000000001000000-0x000000000101B000-memory.dmp

Filesize
108KB

Download
memory/2360-36-0x0000000001000000-0x000000000101B000-memory.dmp

Filesize
108KB

Download
memory/2360-37-0x0000000001000000-0x000000000101B000-memory.dmp

Filesize
108KB

Download