d4fc8c0f6f82e08b38695a55add0c66ef8b679fbd05510e44ab1e315c266f328

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

79290a7932678e15ea3efb23788e0bd9_JaffaCakes118.exe
Size

108KB
MD5

79290a7932678e15ea3efb23788e0bd9
SHA1

8dc83219fba2a204dd18b137236263861ce9179a
SHA256

d4fc8c0f6f82e08b38695a55add0c66ef8b679fbd05510e44ab1e315c266f328
SHA512

c810c4b1f2038ed8b61cb71ee691b60e963f724cafd2e66bfbc436dd25b0a11c48f4f43bdd3b9edc44d649a4c4736cd336cf62c49e5b92cb7357c747ff569a75
SSDEEP

3072:YszZnKNLSfWInbuLB9xeCBLu4+uIrjDHm1G6H:Ys8ZSfWInb7CRu4EjDKJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2036	fsetup.exe

Loads dropped DLL 4 IoCs

pid	Process
2072	79290a7932678e15ea3efb23788e0bd9_JaffaCakes118.exe
2036	fsetup.exe
2036	fsetup.exe
2036	fsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2036	2072	79290a7932678e15ea3efb23788e0bd9_JaffaCakes118.exe	28
PID 2072 wrote to memory of 2036	2072	79290a7932678e15ea3efb23788e0bd9_JaffaCakes118.exe	28
PID 2072 wrote to memory of 2036	2072	79290a7932678e15ea3efb23788e0bd9_JaffaCakes118.exe	28
PID 2072 wrote to memory of 2036	2072	79290a7932678e15ea3efb23788e0bd9_JaffaCakes118.exe	28
PID 2072 wrote to memory of 2036	2072	79290a7932678e15ea3efb23788e0bd9_JaffaCakes118.exe	28
PID 2072 wrote to memory of 2036	2072	79290a7932678e15ea3efb23788e0bd9_JaffaCakes118.exe	28
PID 2072 wrote to memory of 2036	2072	79290a7932678e15ea3efb23788e0bd9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\79290a7932678e15ea3efb23788e0bd9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\79290a7932678e15ea3efb23788e0bd9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\fsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\fsetup.exe" abev6
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fsetup.exe

Filesize
23KB

MD5
c30456f2caf1bf9c2379bf01f8032898

SHA1
120c7f02acb3f33740cf63eab7d52877ae9e29f2

SHA256
6bc76139fcbd9f568f3192a51c3c3fac6e741b44c755994eb2b2a7cf3eddfe27

SHA512
7167a80a96ea008eed2d7f3de35ecd0958c97ec87a58e6b50e6de8c42cea9c009bf1d6e7f25aad437664a3f4b6c26e9ede93055c9f735749fbbeeacf2b72f1d2

Download Submit
memory/2036-19-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2072-20-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2072-25-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download