ec669fc156f2704f992b01b74192481de2e38caeed85757b2b6567cf6211c743

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07188248511e854fae7652110f5d2bed_JaffaCakes118.exe
Size

32KB
MD5

07188248511e854fae7652110f5d2bed
SHA1

2be6c1d805c59c130c026bdfe100a19101ec60d4
SHA256

ec669fc156f2704f992b01b74192481de2e38caeed85757b2b6567cf6211c743
SHA512

eac0dc03195dc56ce9e2277ce7d3f7d26dc401aebc47a12fd5702e036e6869a426183168bfe0c85b83cada31a8769c577238c8d63268424af793b0a445fd92ab
SSDEEP

768:Z/ZPeth94klsbmTnLEVZF6Nxo8O7xuaGEgGXSAQCqLajeJIGEgG:ZChiisaLEVZFyo9uNEgIyCGa+Eg

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\K9X9JYXHY\V8QFXS.exe	07188248511e854fae7652110f5d2bed_JaffaCakes118.exe
File opened for modification	C:\Program Files\K9X9JYXHY\V8QFXS.exe	07188248511e854fae7652110f5d2bed_JaffaCakes118.exe
File created	C:\Program Files\K9X9JYXHY\K0G0XXVFLC.exe	07188248511e854fae7652110f5d2bed_JaffaCakes118.exe
File opened for modification	C:\Program Files\K9X9JYXHY\K0G0XXVFLC.exe	07188248511e854fae7652110f5d2bed_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
216	07188248511e854fae7652110f5d2bed_JaffaCakes118.exe
216	07188248511e854fae7652110f5d2bed_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\07188248511e854fae7652110f5d2bed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07188248511e854fae7652110f5d2bed_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4116,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
1⤵
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MADB42LHNKC.exe

Filesize
9.0MB

MD5
9179b3aad4e3015d145ae0877991206f

SHA1
69e1fd5d4f4cbda32cbb05d9b33d979138c3d922

SHA256
3e80d6e9f7164d2cee5e14cd7ca24c34af89402aafce614019260e986cef105e

SHA512
d6f11cc2174181bbe913d97de65758e1be5270384dcd1b3913801098d9813e89ac3a1292be9af967ce811c29c95cec16d06f6eb89e967a224c8c7387b248aec5

Download Submit