14ceec477f02a3b5bb0c0e234a155a05f8729feb88ff4b558f8a160df412cdba

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe
Size

874KB
MD5

6be9f65d8a85b38cc6d32416ffdfe077
SHA1

26c031e9666c258cd5a6f06cfe35e4d1d206b078
SHA256

14ceec477f02a3b5bb0c0e234a155a05f8729feb88ff4b558f8a160df412cdba
SHA512

48aa92be20c11c3667494c678e0b10675d0dfd6dcd6ec2dd49da9522cf71ab3324cf0b9babaa53c7cdc58950968335f0cd6fa4f90bf5790ac5f4132d69c7d688
SSDEEP

24576:GWMLKmtvPyHu7QEEo/FP7iy9pNg4W7HMcbcN+2QHCoa:fiKmHyOyOhop7scCQ6

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
1268	6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe
1268	6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe
1268	6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe
1268	6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe
1268	6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe
1268	6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 3224	2100	6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe	83
PID 2100 wrote to memory of 3224	2100	6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe	83
PID 2100 wrote to memory of 3224	2100	6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe	83
PID 3224 wrote to memory of 1268	3224	6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe	84
PID 3224 wrote to memory of 1268	3224	6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe	84
PID 3224 wrote to memory of 1268	3224	6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Users\Admin\AppData\Local\Temp\6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6be9f65d8a85b38cc6d32416ffdfe077_JaffaCakes118.exe"
    3⤵
    - Loads dropped DLL
    - Checks whether UAC is enabled
    PID:1268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CsEIMMUliJah8TwbFdX\extramod.dll

Filesize
73KB

MD5
92381441091f304309e7ca8664ae2c5e

SHA1
68b13b25acaacfc71dd799dc6e048b4155845a3d

SHA256
be0394b5fa8853cc25ab6b7aa9715a836d49e52ea21053608124e1d78056b50f

SHA512
dd0b14b0195cf45169345e052744e1ed2b52a1a2f1df38335188a22fc843116f686ddcba7cf5a7cddae3b0719026c0791656866508d68c1328a23f6363d31b15

Download Submit
C:\Users\Admin\AppData\Local\Temp\CsEIMMUliJah8TwbFdX\loading_screen.dll

Filesize
5KB

MD5
44dac7f87bdf94d553f8d2cf073d605d

SHA1
21bf5d714b9fcab32ba40ff7d36e48c378b67a06

SHA256
0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66

SHA512
92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

Download Submit
C:\Users\Admin\AppData\Local\Temp\CsEIMMUliJah8TwbFdX\lua51.dll

Filesize
494KB

MD5
f0c59526f8186eadaf2171b8fd2967c1

SHA1
8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb

SHA256
6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6

SHA512
dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

Download Submit
C:\Users\Admin\AppData\Local\Temp\CsEIMMUliJah8TwbFdX\shared_library.dll

Filesize
200KB

MD5
ac4345579a4b958826980af748912433

SHA1
1fb076783cdf5cca3d1a53a5e2a4f2089773f20b

SHA256
7986209c208614bb80da6b9a020e19dcce64fa80324d131c163ec3c9d0be048e

SHA512
7eda817c0414797c91e98d79e9ebf3df4ea8432a06f34c77ea03917fc6d8adbbf60b3154eab99800fe5aa7b95633aa87f27bb6a46e129694813fa80059e2d9d1

Download Submit
memory/1268-14-0x00000000005B0000-0x00000000005E6000-memory.dmp

Filesize
216KB

Download
memory/1268-23-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1268-21-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1268-22-0x000000007FE30000-0x000000007FE40000-memory.dmp

Filesize
64KB

Download
memory/1268-20-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1268-19-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1268-18-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1268-17-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1268-29-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/1268-7-0x0000000000580000-0x0000000000596000-memory.dmp

Filesize
88KB

Download