c004842ec3c1a768aefe6ac2bd8114c3e4d963f57d2109c90ff225dd3b2e6b7e

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.exe
Size 2.7MB
Sample240612-24hbjayakj
SHA256 c004842ec3c1a768aefe6ac2bd8114c3e4d963f57d2109c90ff225dd3b2e6b7e
MD5 a2da427b29e3098b126120c4a8b2c6da
SHA1 52cfda96dd4e19b78fd538530f48343d0905cb6d
SHA512 22087ee90dca1550bdf4e4620041d27e12a060cddf4edbaba4500219c53d5a4338867b4b8b75d31b8faed3b08b18e1b12153766aa9af7dad8092c94e9acbaaa8
SSDEEP 49152:MZ74mej7s9QlRZPswbIEvSD7haUNs/NW5GsA1L5jl89ebA5rOYiZnL:MN4aKfE0IPhaUNs3XtpAebSivZnL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3308	a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.tmp

Loads dropped DLL 2 IoCs

pid	Process
3308	a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.tmp
3308	a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3308	a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.tmp
3308	a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.tmp
3308	a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.tmp
3308	a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 3308	4888	a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.exe	91
PID 4888 wrote to memory of 3308	4888	a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.exe	91
PID 4888 wrote to memory of 3308	4888	a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Temp\is-1KT0V.tmp\a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1KT0V.tmp\a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.tmp" /SL5="$D0052,2132727,70144,C:\Users\Admin\AppData\Local\Temp\a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4388 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-1KT0V.tmp\a2da427b29e3098b126120c4a8b2c6da_JaffaCakes118.tmp
Size 1.2MB
SHA256 64e1f1fa7d91920b17bc7bc679a4cd8d87ff5b104318b6921bb6bf6a19055635
MD5 e7106fbf42fbc6d5b08a18ada4f781b4
SHA1 36d4a629f79d772c0b0df8bd2ae2ea09108d239d
SHA512 adf876296a952aadeb4f25211c0939bf5a278809b5d3007ad7e26c5d4975e7684d242c1b3de796efd474a47cb7ecdb80f9047935924a1108bf0e4d7c973d1845
SSDEEP 24576:nmdW7w83t6Wea8u0105qwD7Xw9FiLDuC0vOoVSIgHNnvExCc:nBwZ05qXqdEfgNNQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

DownLib.dll

Path C:\Users\Admin\AppData\Local\Temp\is-E083R.tmp\DownLib.dll
Size 183KB
SHA256 1b66aaf1e7e3c493dd96af3b7442ea60072f6e93ba45281eacd31a14ca7e7e73
MD5 db25dfdd4c1f2b65c68a230881072695
SHA1 94cd6a3438041f0e61b0a1bea7b66461854efe69
SHA512 db69e4ab2218856e5184d9094e7e39705b83e3efdc15225067205c8faf6e5836145364f1d509192defa3b48864e72b9f8c0f2dc53a7adb2b86c655318b7afc2c
SSDEEP 3072:8PTvPOTqEwknuXlb+JfIp1tBKBGIx/W0eC1iXfQA3orZxRqCTZSc9Fm:8PTuVRu1UE8Bx31SfQA3UpvF
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupcfg.ini

Path C:\Users\Admin\AppData\Local\Temp\is-E083R.tmp\setupcfg.ini
Size 44B
SHA256 aa3dd4239988bb1b4e7f729a6e06cd30d8a32d081cf1eaa0c116878377e674c8
MD5 1ad893b4d9d0c78d66f1da5e506cf645
SHA1 d98f0a24212775a2329819c69386c891bfe1ba9b
SHA512 d4ba9271432a3908494340b6cff30a5ebd0968658f036eb8794f1c9cab02d05d5dc40e25cd10d33cb67ed408721c83655c48046f0f18ad9da97fc8901dc56d47
MD5 SHA1 SHA512

Submit Download

tbr_dots.bmp

Path C:\Users\Admin\AppData\Local\Temp\is-E083R.tmp\tbr_dots.bmp
Size 164B
SHA256 7e7f18c73560f9c020abe1ab1f22705083281e2ea16ab0030fc927901b5b5d1e
MD5 adc799ec79eeaef366ea4dddf099c3ae
SHA1 556c915615a34a2499604b7b732ab304b20fdd4e
SHA512 76962a17cc26d3f9886828be4e43373ac530165e1c627272ed7c0bc731133e97608e55d2e31f44592aad0d0974352155f41a0718aa0666ec128406b1050c1d6c
MD5 SHA1 SHA512

Submit Download

memory/3308-7-0x0000000000400000-0x0000000000536000-memory.dmp

Download

memory/3308-20-0x0000000003C20000-0x0000000003C57000-memory.dmp

Download

memory/3308-127-0x0000000000400000-0x0000000000536000-memory.dmp

Download

memory/3308-128-0x0000000003C20000-0x0000000003C57000-memory.dmp

Download

memory/4888-0-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4888-2-0x0000000000401000-0x000000000040D000-memory.dmp

Download

memory/4888-126-0x0000000000400000-0x0000000000418000-memory.dmp

Download