20fa273a35371fa075dcc73ecc603d76b4f490464ba71feec2c7edb4ae738adf

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93d54efb768dc9a1944dd559334b58ef_JaffaCakes118.exe
Size

118KB
MD5

93d54efb768dc9a1944dd559334b58ef
SHA1

2a0725418e513b4d3a8ce5ccbd5475e4a218ddba
SHA256

20fa273a35371fa075dcc73ecc603d76b4f490464ba71feec2c7edb4ae738adf
SHA512

7bcb2e6c8c904824d7134b386d1cd31719c5d7a7e2448732e0f3fd1d7e8461fda7579a569a1c860f26295ea20222918adce5020728cdbac203720f5dc8d56a14
SSDEEP

1536:iHgtlVWd3jnQzH4F17hNit0I+uRgsjtPHHO:iHg3cVrQzH67h76dH

Score

1^/10

Malware Config

Signatures

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3080	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3080	NETSTAT.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 5112	1496	93d54efb768dc9a1944dd559334b58ef_JaffaCakes118.exe	83
PID 1496 wrote to memory of 5112	1496	93d54efb768dc9a1944dd559334b58ef_JaffaCakes118.exe	83
PID 1496 wrote to memory of 5112	1496	93d54efb768dc9a1944dd559334b58ef_JaffaCakes118.exe	83
PID 5112 wrote to memory of 3080	5112	cmd.exe	84
PID 5112 wrote to memory of 3080	5112	cmd.exe	84
PID 5112 wrote to memory of 3080	5112	cmd.exe	84
PID 5112 wrote to memory of 3480	5112	cmd.exe	94
PID 5112 wrote to memory of 3480	5112	cmd.exe	94
PID 5112 wrote to memory of 3480	5112	cmd.exe	94
PID 5112 wrote to memory of 2528	5112	cmd.exe	95
PID 5112 wrote to memory of 2528	5112	cmd.exe	95
PID 5112 wrote to memory of 2528	5112	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\93d54efb768dc9a1944dd559334b58ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\93d54efb768dc9a1944dd559334b58ef_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3141.tmp\zbpc check.cmd""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -b
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:3080
- - C:\Windows\SysWOW64\findstr.exe
    findstr ":8080 :8000" C:\Users\Admin\AppData\Local\Temp\zbcheck.txt
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\findstr.exe
    findstr ":8080 :8000" C:\Users\Admin\AppData\Local\Temp\zbcheck.txt
    3⤵
    PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3141.tmp\zbpc check.cmd

Filesize
924B

MD5
d32604c9b7ad62116477c693d392d167

SHA1
71c5afd24a84c6cf0c6ac3e6c0687a0bdff0185e

SHA256
b15f8ab3f8af55a88d747e1bfa46265042063d97b78baba9700f91675ca36c5e

SHA512
6fe385e74677503a79f1984feaaf3c8289fe9f3cbe6b244454fde8e55345feec97ae941ad93ce2d5f4d39632ac4d355b16d5cb4d71e4139f00beda2117c1a901

Download Submit
C:\Users\Admin\AppData\Local\Temp\zbcheck.txt

Filesize
771B

MD5
a6a04a83e686a5a8c95380179f110b7d

SHA1
a34911b2d2aee0d8373fc077bb537b93f5e475e1

SHA256
409bb332e117a7abd9c37de03fc75975bac034e4f25fda0ba64eea372bb00062

SHA512
2eed4881238ef71d4cabc8750eb5154cabd3bfdbbdacd64ca90823cb58643321fa7f186c5922bc605358e43235b8c4aa5dbd18e3f24cec06d2b6479325ac38dc

Download Submit