23d38c17e01aefaa19a269f97a2ef1ccec8e3f928c1380ec8e1e8746db5d73a1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:50

Target

6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe
Size

469KB
MD5

6595fcfb1f28b4e752d0f5298a4a8f95
SHA1

b7f03fe7565142aae9765ceaff37473b5f8f7488
SHA256

23d38c17e01aefaa19a269f97a2ef1ccec8e3f928c1380ec8e1e8746db5d73a1
SHA512

7ada816b962f033e1236b8988b1099cb7c6a4d562e22ec75d43053fba9b4989cd82228ebcf8a72f9f288cd1919fb5d75b46e1fd72688265a8c00b7c55b433e4c
SSDEEP

12288:6pmpk9KIvFu0YOG1awpy3Swr/wwGeBn58THWI8DjX6:cmsFu0a8LiwzwUPPX6

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2716 cmd.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3024 PING.EXE

pid	process
2716	cmd.exe

pid	process
3024	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 2068 wrote to memory of 2716	2068	6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe	cmd.exe
PID 2068 wrote to memory of 2716	2068	6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe	cmd.exe
PID 2068 wrote to memory of 2716	2068	6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe	cmd.exe
PID 2068 wrote to memory of 2716	2068	6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe	cmd.exe
PID 2716 wrote to memory of 3024	2716	cmd.exe	PING.EXE
PID 2716 wrote to memory of 3024	2716	cmd.exe	PING.EXE
PID 2716 wrote to memory of 3024	2716	cmd.exe	PING.EXE
PID 2716 wrote to memory of 3024	2716	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:3024

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/2068-0-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2068-1-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2068-2-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2068-3-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2068-4-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download