5d20686684e27296a923e1d762684e20e62710a0405e1a33ef5406a60456c3b1

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91a195c500e9db03d7156c6fe9298537_JaffaCakes118.exe
Size 100KB
Sample240603-npcwlsda3v
SHA256 5d20686684e27296a923e1d762684e20e62710a0405e1a33ef5406a60456c3b1
MD5 91a195c500e9db03d7156c6fe9298537
SHA1 6d166f2bbc2d85f85d8f3e588b92dbf2e5a6694c
SHA512 b17ba3288afebd9b0882aaaf2a587a39602dc99fe9beae76360092fdce406b9e22e13e19f22f66b64b54e85df0df18af8a9950542e970c62cff30088e66f982c
SSDEEP 1536:LyEY+7m3T/bac6Ut0gVxPaCoKr5dQbqoW+BW9dsFKDNqExL/JXYZQ79712W:xz7m3jbz6yu7KrfITQsoNlXYZQ7OW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3804	ailcopy.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	ailcopy.exe
File opened (read-only)	\??\H:	ailcopy.exe
File opened (read-only)	\??\M:	ailcopy.exe
File opened (read-only)	\??\O:	ailcopy.exe
File opened (read-only)	\??\S:	ailcopy.exe
File opened (read-only)	\??\A:	ailcopy.exe
File opened (read-only)	\??\I:	ailcopy.exe
File opened (read-only)	\??\N:	ailcopy.exe
File opened (read-only)	\??\P:	ailcopy.exe
File opened (read-only)	\??\U:	ailcopy.exe
File opened (read-only)	\??\W:	ailcopy.exe
File opened (read-only)	\??\Q:	ailcopy.exe
File opened (read-only)	\??\R:	ailcopy.exe
File opened (read-only)	\??\T:	ailcopy.exe
File opened (read-only)	\??\Y:	ailcopy.exe
File opened (read-only)	\??\Z:	ailcopy.exe
File opened (read-only)	\??\X:	ailcopy.exe
File opened (read-only)	\??\B:	ailcopy.exe
File opened (read-only)	\??\E:	ailcopy.exe
File opened (read-only)	\??\J:	ailcopy.exe
File opened (read-only)	\??\K:	ailcopy.exe
File opened (read-only)	\??\L:	ailcopy.exe
File opened (read-only)	\??\V:	ailcopy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3804	2168	91a195c500e9db03d7156c6fe9298537_JaffaCakes118.exe	83
PID 2168 wrote to memory of 3804	2168	91a195c500e9db03d7156c6fe9298537_JaffaCakes118.exe	83
PID 2168 wrote to memory of 3804	2168	91a195c500e9db03d7156c6fe9298537_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\91a195c500e9db03d7156c6fe9298537_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\91a195c500e9db03d7156c6fe9298537_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\ailcopy.exe
  C:\Users\Admin\AppData\Local\Temp\ailcopy.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  PID:3804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AilCopy.exe

Path C:\Users\Admin\AppData\Local\Temp\AilCopy.exe
Size 88KB
SHA256 bfdc14229df80452039469eff3be01b2e4d6194aa660c97e3b5da0ccdd23af9f
MD5 1e3142626f24593ded06e60c873ff8be
SHA1 e9a6b22c68143be7bb6a5dad360e3572a5ec021c
SHA512 409a0f10865a5a1a1aef5bd266872135a1ee52b946c3316b9b0fb54e00cf5baaa1e6658b670042790e02002f1b36282e8968844524c6bc8211ba38819385a667
SSDEEP 1536:BfED+z2F8MDs9mji/b7Hn7SeRMmI9BQnfkoo734LX:JED+z6s9mji/T8PBQnfkoo73KX
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.lst

Path C:\Users\Admin\AppData\Local\Temp\setup.lst
Size 2KB
SHA256 a45e1e5d14cfe065857c0905041648a2a10315a0ca101c73a68289988ab73bc1
MD5 75a7a838d1136562383129574bdbd6c3
SHA1 e2967b1a5fb08281473d736ab2cb34cd6959e002
SHA512 6d3ccd20685b6c6a2dbc81c2d605d99b14a3fd9c0f819c68ea639100a2e606323b962245c7f4a50640dcaf69fddb300d1a91d109d792267722029ea3a0b44698
MD5 SHA1 SHA512