fbf0b4749dfb9796df8853f64768893c3bd8c4d69653a1bc7525cfed635351dd

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

195023bcf047d9f16af842057455546d_JaffaCakes118.exe
Size

19.6MB
MD5

195023bcf047d9f16af842057455546d
SHA1

c47b3681c028c30b4325f32aa9c8cffab30fa230
SHA256

fbf0b4749dfb9796df8853f64768893c3bd8c4d69653a1bc7525cfed635351dd
SHA512

5e3f5160bc9efaaa1ed6c396c109b6562d30b67799f19ad32bd6bfeae2ef65a4b37bb371c0583be56f18114578b97037411f6ef2dec7d880c2ad4bc8c2d840eb
SSDEEP

98304:O6Eh1s2tExE3yXF8/5/hBuGFGxpLeK8U05/:WqxE3q+/w3xpPIl

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Antispyware Scheduled Scan.job	195023bcf047d9f16af842057455546d_JaffaCakes118.exe
File created	C:\Windows\Tasks\Antispyware System Startup.job	195023bcf047d9f16af842057455546d_JaffaCakes118.exe
File opened for modification	C:\Windows\Tasks\Antispyware Scheduled Scan.job	195023bcf047d9f16af842057455546d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	1500	195023bcf047d9f16af842057455546d_JaffaCakes118.exe
Token: SeRestorePrivilege	1500	195023bcf047d9f16af842057455546d_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1500	195023bcf047d9f16af842057455546d_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1500	195023bcf047d9f16af842057455546d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1500	195023bcf047d9f16af842057455546d_JaffaCakes118.exe
1500	195023bcf047d9f16af842057455546d_JaffaCakes118.exe
1500	195023bcf047d9f16af842057455546d_JaffaCakes118.exe
1500	195023bcf047d9f16af842057455546d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\195023bcf047d9f16af842057455546d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\195023bcf047d9f16af842057455546d_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Tasks\Antispyware Scheduled Scan.job

Filesize
604B

MD5
aa7ae8fb876bec0c6569e530d5938511

SHA1
fe0614557588f772abebbb734819de74a02cfbdd

SHA256
8cd2c732dbfefc0aef054797e25893050320c506b5dc006170964cc639163df4

SHA512
589358fc6e942a29022b390a5eca04f140fb5e01ec49018e42a5cd01e656e317b0655e18fde6b24202c4616dfa52780493ec05aac030311faeaf9187e3b86a0b

Download Submit