23d38c17e01aefaa19a269f97a2ef1ccec8e3f928c1380ec8e1e8746db5d73a1

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:50

Target

6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe
Size

469KB
MD5

6595fcfb1f28b4e752d0f5298a4a8f95
SHA1

b7f03fe7565142aae9765ceaff37473b5f8f7488
SHA256

23d38c17e01aefaa19a269f97a2ef1ccec8e3f928c1380ec8e1e8746db5d73a1
SHA512

7ada816b962f033e1236b8988b1099cb7c6a4d562e22ec75d43053fba9b4989cd82228ebcf8a72f9f288cd1919fb5d75b46e1fd72688265a8c00b7c55b433e4c
SSDEEP

12288:6pmpk9KIvFu0YOG1awpy3Swr/wwGeBn58THWI8DjX6:cmsFu0a8LiwzwUPPX6

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3348 PING.EXE

pid	process
3348	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 2648 wrote to memory of 4568	2648	6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe	cmd.exe
PID 2648 wrote to memory of 4568	2648	6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe	cmd.exe
PID 2648 wrote to memory of 4568	2648	6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe	cmd.exe
PID 4568 wrote to memory of 3348	4568	cmd.exe	PING.EXE
PID 4568 wrote to memory of 3348	4568	cmd.exe	PING.EXE
PID 4568 wrote to memory of 3348	4568	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\6595fcfb1f28b4e752d0f5298a4a8f95_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4568

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:3348

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2648-0-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2648-1-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2648-3-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2648-2-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download