66d25da4579f9e27ea061f161c3f4aae5b09d68b4262b3997543a31625354ec3

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
Size

5.6MB
MD5

b64686c70beedc696c28b436ceef79fb
SHA1

5991c793c8dcc10acab1e56608495bf51d4296a0
SHA256

66d25da4579f9e27ea061f161c3f4aae5b09d68b4262b3997543a31625354ec3
SHA512

a94b5c2b7ec84882f00177bb693ccd3008dbe24471fe2d98d01d512b5c44b8e7f205702e46178e1b49cf7baebb9a7e7e0b86917ba9dee94458b8316bc3b4ce7c
SSDEEP

98304:kDHGCyfBp7C7mebROWHGZrtz4jWESp3MMMn:umpT7C7vOWHGZrtsjWESJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
1808	b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b64686c70beedc696c28b436ceef79fb_JaffaCakes118.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4164,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:8
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Settings.ini

Filesize
27B

MD5
7580e1c4b722faf5e8e88ddddce84e81

SHA1
50fa8f28458f26ab3c6a72ab0798e15bee7e3bdb

SHA256
7cc64c281981ae3b4094fcbd512bed5d5ffb7ba0d0748b14e154af8a68457ef3

SHA512
a64037168c01cb18dfba4758df9e154399ec473c1199375a6b730fdfd4bbb04d6fa659ffa4e9bfe56371578eee7dd6eec4a3ba2f8fc1422a35f110a8d4fc90be

Download Submit
memory/1808-29-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/1808-31-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/1808-24-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/1808-25-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/1808-26-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/1808-27-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/1808-23-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/1808-28-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/1808-30-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/1808-0-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/1808-32-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/1808-33-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/1808-34-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/1808-35-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/1808-36-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/1808-37-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download