7d1ebd39bca958d15fe431cb57c28584365dd29ceb88c95f435aeeb1235fc414

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

79de363831a2342e307eb915a339a9ea_JaffaCakes118.exe
Size

161KB
MD5

79de363831a2342e307eb915a339a9ea
SHA1

11e7e530e8dfc88f11741f9217cb2cba345d20e2
SHA256

7d1ebd39bca958d15fe431cb57c28584365dd29ceb88c95f435aeeb1235fc414
SHA512

0106719742c662ba32238a21880adabf7eaa561f3b50909ce2077a0658ecb856cb5e40d13a901084fc6f8c9012fd7df29d246292ad1c035fd4e26a8aee6bb616
SSDEEP

3072:dqnyWt+C25wRXv1fasYttOWHD44lU9guWg5McaH:xr5wRpadHj7gj2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5020	79de363831a2342e307eb915a339a9ea_JaffaCakes118.exe
5020	79de363831a2342e307eb915a339a9ea_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\79de363831a2342e307eb915a339a9ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\79de363831a2342e307eb915a339a9ea_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\index.html

Filesize
7KB

MD5
98c45cca9bee3a206a2aa669559bed0f

SHA1
bd8f11d1f758816e065ffe46add6ce6b9932784a

SHA256
fb7836167c59cb32c533c9a88f5280250f2c453ef5ded0bb87c2543992784005

SHA512
4fac1716f814862339a1c660c3d23de0e3bf787205bb0aa4007bf722278c9afb152306f21690d9368ec7f77e48ad944bbcc58313fe1014d4ddb8ad32844244b0

Download Submit