143c66195748f6b58947648fa1afad83edc1fbe864fdf125f90dac4702259920

Analysis

max time kernel
132s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:40

Target

68b9f68fa26759034ca8b2fdac3e4ee5_JaffaCakes118.exe
Size

458KB
MD5

68b9f68fa26759034ca8b2fdac3e4ee5
SHA1

166b902ce7fcce26d6dae8e1adbdea953523ca7b
SHA256

143c66195748f6b58947648fa1afad83edc1fbe864fdf125f90dac4702259920
SHA512

8c544235e5e93a4a8d9cda270f79865eb248abf7b3e0ae735098b6b763837c208bef1e6ea3a623718220a6bae3215aa7ff60848f92d194a96d0d0e2af5af95ec
SSDEEP

6144:y2v+FSyURbz76Dmp3NShvPQDtPMf7skL7j/jUwARVeM5a3Mdh50fgSR2gm:Xv+gRX72mp3NS1Yp2skDIr+2h5sm

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3964 PING.EXE

pid	process
3964	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

68b9f68fa26759034ca8b2fdac3e4ee5_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 2996 wrote to memory of 5084	2996	68b9f68fa26759034ca8b2fdac3e4ee5_JaffaCakes118.exe	cmd.exe
PID 2996 wrote to memory of 5084	2996	68b9f68fa26759034ca8b2fdac3e4ee5_JaffaCakes118.exe	cmd.exe
PID 2996 wrote to memory of 5084	2996	68b9f68fa26759034ca8b2fdac3e4ee5_JaffaCakes118.exe	cmd.exe
PID 5084 wrote to memory of 3964	5084	cmd.exe	PING.EXE
PID 5084 wrote to memory of 3964	5084	cmd.exe	PING.EXE
PID 5084 wrote to memory of 3964	5084	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\68b9f68fa26759034ca8b2fdac3e4ee5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68b9f68fa26759034ca8b2fdac3e4ee5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\68b9f68fa26759034ca8b2fdac3e4ee5_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
1⤵
PID:2564

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/2996-0-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2996-1-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2996-2-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2996-3-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download