18fb20ed7ff9283ccc1bc57009a2b386120b62a3160c3a29e71224a7985814a9 | Triage

Analysis

max time kernel
0s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 19:58

Sharing

Reason

Machine shutdown

Report Analysis Logs

General

Target

17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe
Size

183KB
MD5

17546c6eefe30582794148e2c44b139f
SHA1

174834367ee22cb6a8363bcfffb35721bf704292
SHA256

18fb20ed7ff9283ccc1bc57009a2b386120b62a3160c3a29e71224a7985814a9
SHA512

d15e1640de3b98567025f71f7b2070087b6b362fd5ba752ffd9db12985d5f3222cb67848ceeec3fa66413cedc3373e2b206ee84d9e19c693ae98ca39fcef25ea
SSDEEP

3072:DQIURTXJ+MMrO+zWsLU9HmWAjT2T8upS8XyrdxhDRGChzjq40IiZS6nbSmujGlaU:Ds9Az9UtpTjfIdRXP0Iis6nkGVr

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe"
1⤵
PID:3704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\tmrllozg.dll",DllMain
  2⤵
  PID:4268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\tmrllozg.dll

Filesize
183KB

MD5
440dd855fbe2c10aa8fa70f09cb208ec

SHA1
5499a0ee810cc7d4deeb48b7b394c3bfb3f935fd

SHA256
4e354cd5d03c9cec1754ad60748fe35369b8fa50d870e28026835f84b8143a09

SHA512
41a6ac3d2bf2f6d29a05a92aa20a25b4f80182c06ecab506931c477b06fc0b41f5cc3c9cc5a3e3c3204449fb31116f26d2678844d0933383272645dd9b817d7f

Download Submit
memory/4268-5-0x0000000002D10000-0x0000000002D3E000-memory.dmp

Filesize
184KB

Download
memory/4268-4-0x0000000002C70000-0x0000000002C9E000-memory.dmp

Filesize
184KB

Download
memory/4268-7-0x0000000002D10000-0x0000000002D3E000-memory.dmp

Filesize
184KB

Download
memory/4268-6-0x0000000002CA0000-0x0000000002CD2000-memory.dmp

Filesize
200KB

Download