28fd7b846dca0b27eda973ad7a2769c79ecc0284372156faaa4200149287ad6e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688a1623f804225d587449ad62265d74_JaffaCakes118.exe
Size

454KB
MD5

688a1623f804225d587449ad62265d74
SHA1

ebeacc78476ce563aefe61d325a7e08c741a6a01
SHA256

28fd7b846dca0b27eda973ad7a2769c79ecc0284372156faaa4200149287ad6e
SHA512

7f0cd2a7599cec7322c486de666a6d1fd82be44394258fd9b5a22a865d2095cda37ea41f3172830a563da977e20d37db5e2aa494a002be5daffdc7a594834087
SSDEEP

12288:Ez80DKNX1xuxaldIByN148ywU0EsRewVKRWq:EzRKNsd0oRWq

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

688a1623f804225d587449ad62265d74_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\688a1623f804225d587449ad62265d74_JaffaCakes118.lnk	688a1623f804225d587449ad62265d74_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

Processes:

688a1623f804225d587449ad62265d74_JaffaCakes118.exe

pid process

616 688a1623f804225d587449ad62265d74_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
616	688a1623f804225d587449ad62265d74_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\688a1623f804225d587449ad62265d74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\688a1623f804225d587449ad62265d74_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
PID:616

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\{79c25e84-b200-27f4-79c2-25e84b207a12}\688a1623f804225d587449ad62265d74_JaffaCakes118.exe
Filesize
454KB

MD5
688a1623f804225d587449ad62265d74

SHA1
ebeacc78476ce563aefe61d325a7e08c741a6a01

SHA256
28fd7b846dca0b27eda973ad7a2769c79ecc0284372156faaa4200149287ad6e

SHA512
7f0cd2a7599cec7322c486de666a6d1fd82be44394258fd9b5a22a865d2095cda37ea41f3172830a563da977e20d37db5e2aa494a002be5daffdc7a594834087

Download Submit
memory/616-18-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/616-27-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/616-17-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/616-28-0x0000000002000000-0x0000000002001000-memory.dmp

Filesize
4KB

Download
memory/616-16-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/616-26-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/616-25-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/616-24-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/616-23-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/616-22-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/616-21-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/616-15-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/616-19-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/616-0-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/616-7-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/616-2-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/616-20-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/616-14-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/616-13-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/616-12-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/616-11-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/616-10-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/616-9-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/616-8-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/616-3-0x0000000000340000-0x0000000000366000-memory.dmp

Filesize
152KB

Download
memory/616-32-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/616-31-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/616-34-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/616-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download