b19913959faa72b44171ddd589d0344d65081d7e7b53af1a6f74fa6c080d546e

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0681c1b496cecb6860b9b30021307e76_JaffaCakes118.exe
Size

2.9MB
MD5

0681c1b496cecb6860b9b30021307e76
SHA1

747b183018e0553e765a18f15165eecc79ac1fd5
SHA256

b19913959faa72b44171ddd589d0344d65081d7e7b53af1a6f74fa6c080d546e
SHA512

5ab54045ed1024cd6d52ca1dea78cfe76b48141ac7cfa74b6752bfdc35d45cfaaf38054e33d133fb04024d31ffedabf2a3dd0570b2cc0836f71dd27ccbfb54be
SSDEEP

49152:++fqR1p1m26L6SeC4ItkAkQoDV8ZCmoKKKPP7FVbqFUFhntIWJJVGk9Vou/:++fG1p1B6L6NItkAO+Z9oMPP7/bqqLtl

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2684	sexyss123.exe_tmp.exe

Loads dropped DLL 1 IoCs

pid	Process
2056	0681c1b496cecb6860b9b30021307e76_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Alessandra Ambrosio Sexy Screensaver Uninstaller.exe	0681c1b496cecb6860b9b30021307e76_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	sexyss123.exe_tmp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2684	2056	0681c1b496cecb6860b9b30021307e76_JaffaCakes118.exe	28
PID 2056 wrote to memory of 2684	2056	0681c1b496cecb6860b9b30021307e76_JaffaCakes118.exe	28
PID 2056 wrote to memory of 2684	2056	0681c1b496cecb6860b9b30021307e76_JaffaCakes118.exe	28
PID 2056 wrote to memory of 2684	2056	0681c1b496cecb6860b9b30021307e76_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0681c1b496cecb6860b9b30021307e76_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0681c1b496cecb6860b9b30021307e76_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\inst259402768\installer\sexyss123.exe_tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\inst259402768\installer\sexyss123.exe_tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\inst259402768\installer\sexyss123.exe_tmp.exe

Filesize
2.2MB

MD5
72e42e880b94a8bf2c31736a747afa96

SHA1
283d59c16631d7b201e22670da9de163be4dcc48

SHA256
363b63118b17738273079c2b613213bbc72bd954e463e77480143e0a4f6052c4

SHA512
91d3b22ea1772276250ba8c15cdd4ed2a6ef65347363f03cc342db14e43a01d5099b75cf47a3bb63501b5a98df5d6c8c0a61cbbc7a7deaa0e019537969f66707

Download Submit