62785bfab54aff8b4099c82fb0e47513803f90b424fe7aa60c4c3130e43094cd

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
Size

12.8MB
MD5

ad1af65ae75d3d4a3720b8f1a57e03fb
SHA1

569b5add3e119a317fa0414fb17f6546a0e17628
SHA256

62785bfab54aff8b4099c82fb0e47513803f90b424fe7aa60c4c3130e43094cd
SHA512

ee907d8173a961a39e6c0c41541960679c2fb84406f5be3cd62a0c7253a3ae96839d0d5a8b265f41bb4306450fb7e0cdf61874df61f88726922464f0125a0cd1
SSDEEP

393216:61MRhCobRSmt1QaoHR6iCqAddRpqqvMW99LHDlXOlK:66OWuao3CqAd7RvMWnx+A

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Reimage\Reimage Express\	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Reimage\	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe

Loads dropped DLL 21 IoCs

pid	Process
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4672	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4672	tasklist.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 1972	1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe	84
PID 1136 wrote to memory of 1972	1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe	84
PID 1136 wrote to memory of 1972	1136	ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe	84
PID 1972 wrote to memory of 4672	1972	cmd.exe	86
PID 1972 wrote to memory of 4672	1972	cmd.exe	86
PID 1972 wrote to memory of 4672	1972	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ad1af65ae75d3d4a3720b8f1a57e03fb_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq ReiExpressContainer.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq ReiExpressContainer.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt

Filesize
64B

MD5
dea052a2ad11945b1960577c0192f2eb

SHA1
1d02626a05a546a90c05902b2551f32c20eb3708

SHA256
943b315e065238b7073b033f534ef954b6b6461fb3f03a3f5b8555b11bc4c0a2

SHA512
5496b10e2a77aee11055d71bdaaed835df1770e85fa4d0f9433330470bbcf76c932c04778a0b47f4193eee14813db2e2b19ecc50b4a6a193faa19b4019705917

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh5815.tmp\LogEx.dll

Filesize
44KB

MD5
0f96d9eb959ad4e8fd205e6d58cf01b8

SHA1
7c45512cbdb24216afd23a9e8cdce0cfeaa7660f

SHA256
57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314

SHA512
9f3afb61d75ac7b7dc84abcbf1b04f759b7055992d46140dc5dcc269aed22268d044ee8030f5ea260bbb912774e5bbb751560c16e54efa99c700b9fc7d48832c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh5815.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh5815.tmp\inetc.dll

Filesize
31KB

MD5
5da9df435ff20853a2c45026e7681cef

SHA1
39b1d70a7a03e7c791cb21a53d82fd949706a4b4

SHA256
9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

SHA512
4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh5815.tmp\nsExec.dll

Filesize
6KB

MD5
132e6153717a7f9710dcea4536f364cd

SHA1
e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

SHA256
d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

SHA512
9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh5815.tmp\registry.dll

Filesize
24KB

MD5
2b7007ed0262ca02ef69d8990815cbeb

SHA1
2eabe4f755213666dbbbde024a5235ddde02b47f

SHA256
0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

SHA512
aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh5815.tmp\stack.dll

Filesize
10KB

MD5
867af9bea8b24c78736bf8d0fdb5a78e

SHA1
05839fad98aa2bcd9f6ecb22de4816e0c75bf97d

SHA256
732164fb36f46dd23dafb6d7621531e70f1f81e2967b3053727ec7b5492d0ae9

SHA512
b7f54d52ff08b29a04b4f5887e6e3ae0e74fa45a86e55e0a4d362bc3603426c42c1d6a0b2fc2ef574bec0f6c7152de756ff48415e37ae6a7a9c296303562df4b

Download Submit
memory/1136-32-0x0000000004EA0000-0x0000000004EAB000-memory.dmp

Filesize
44KB

Download
memory/1136-39-0x0000000004FA0000-0x0000000004FAB000-memory.dmp

Filesize
44KB

Download
memory/1136-82-0x0000000008BF0000-0x0000000008C49000-memory.dmp

Filesize
356KB

Download