28fd7b846dca0b27eda973ad7a2769c79ecc0284372156faaa4200149287ad6e

Analysis

max time kernel
145s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688a1623f804225d587449ad62265d74_JaffaCakes118.exe
Size

454KB
MD5

688a1623f804225d587449ad62265d74
SHA1

ebeacc78476ce563aefe61d325a7e08c741a6a01
SHA256

28fd7b846dca0b27eda973ad7a2769c79ecc0284372156faaa4200149287ad6e
SHA512

7f0cd2a7599cec7322c486de666a6d1fd82be44394258fd9b5a22a865d2095cda37ea41f3172830a563da977e20d37db5e2aa494a002be5daffdc7a594834087
SSDEEP

12288:Ez80DKNX1xuxaldIByN148ywU0EsRewVKRWq:EzRKNsd0oRWq

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

688a1623f804225d587449ad62265d74_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\688a1623f804225d587449ad62265d74_JaffaCakes118.lnk	688a1623f804225d587449ad62265d74_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\688a1623f804225d587449ad62265d74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\688a1623f804225d587449ad62265d74_JaffaCakes118.exe"
1⤵
- Drops startup file
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:5100

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3304-0-0x00000000001A0000-0x00000000001A2000-memory.dmp

Filesize
8KB

Download
memory/3304-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/3304-2-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/3304-4-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/3304-3-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/3304-5-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/3304-13-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/3304-12-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/3304-11-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/3304-10-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/3304-9-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/3304-8-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/3304-7-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/3304-6-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/3304-15-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/3304-14-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/3304-16-0x00000000008F0000-0x00000000008F2000-memory.dmp

Filesize
8KB

Download
memory/3304-17-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/3304-18-0x0000000000E80000-0x0000000000E81000-memory.dmp

Filesize
4KB

Download
memory/3304-21-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/3304-20-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/3304-19-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/3304-23-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Filesize
4KB

Download
memory/3304-22-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/3304-24-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Filesize
4KB

Download
memory/3304-25-0x0000000000B30000-0x0000000000B56000-memory.dmp

Filesize
152KB

Download
memory/3304-30-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download
memory/3304-31-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/3304-29-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download