14faeb5ba3e5831dd0e8f221b6021020047a1eb5fa8548d71e5fee02141a8bb4

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe
Size 470KB
Sample240613-vfw2fsxbpc
SHA256 14faeb5ba3e5831dd0e8f221b6021020047a1eb5fa8548d71e5fee02141a8bb4
MD5 a69cc6b74b0feec4a1040952e0a3d824
SHA1 966b2672a8a9bd345e5abcae61685de9897524ce
SHA512 acd980fc9129ac3ad9695da0520a345aff6e92ce4b66428bedb603ec311ffa56beeb261f14699d76b2b67823e2f4c2d8a281e5f1c1673e0a2fcc197f3b349e70
SSDEEP 6144:rCMmrKJ1uRdEcZ/vkiR8hozHiFNzsPNvCVieCtqkOSnd509p1q57F4nY:rl7cZ/vFRfew9amnO4D09pi7FGY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1968	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 3416	4292	a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe	94
PID 4292 wrote to memory of 3416	4292	a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe	94
PID 4292 wrote to memory of 3416	4292	a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe	94
PID 3416 wrote to memory of 1968	3416	cmd.exe	96
PID 3416 wrote to memory of 1968	3416	cmd.exe	96
PID 3416 wrote to memory of 1968	3416	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\a69cc6b74b0feec4a1040952e0a3d824_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4292-0-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4292-1-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4292-2-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4292-3-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4292-4-0x0000000000400000-0x0000000000462000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads