20a65a112c1590e9ecc1d99dcf99f6543746a621557ae386d9d199e2e3d6eb22

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af0e51c21c61459b6adaf42de45dded1_JaffaCakes118.exe
Size

458KB
MD5

af0e51c21c61459b6adaf42de45dded1
SHA1

036886293796582b0e475b4bc0e4de6926909b1d
SHA256

20a65a112c1590e9ecc1d99dcf99f6543746a621557ae386d9d199e2e3d6eb22
SHA512

7a7dc4287644c9b5d176bd484c6b7f273f46b61d96b05ed38855f7b62043884b285d812bdc140deef8955c7743f29f55796e848c453832196a0fe8a5f1e1fd48
SSDEEP

6144:UWIA+28ZPhY5dE+wRmoZofiv8xdhHvOd1vdEe5QV+q/J6IAZhMVYFWETDwmPpLOX:UWIAx8ZYuV2fvdhHWme2Vt6rhjWE9PcX

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3956	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 964	3092	af0e51c21c61459b6adaf42de45dded1_JaffaCakes118.exe	98
PID 3092 wrote to memory of 964	3092	af0e51c21c61459b6adaf42de45dded1_JaffaCakes118.exe	98
PID 3092 wrote to memory of 964	3092	af0e51c21c61459b6adaf42de45dded1_JaffaCakes118.exe	98
PID 964 wrote to memory of 3956	964	cmd.exe	100
PID 964 wrote to memory of 3956	964	cmd.exe	100
PID 964 wrote to memory of 3956	964	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\af0e51c21c61459b6adaf42de45dded1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\af0e51c21c61459b6adaf42de45dded1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\af0e51c21c61459b6adaf42de45dded1_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4080,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
1⤵
PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3092-0-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3092-1-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3092-2-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3092-4-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3092-7-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3092-8-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download