1cd2dce18028036d0f435bd254e34935fad7d807ae8f1c839e0ee02e39f01e9c

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe
Size

106KB
MD5

1a2da68f22ea53f8ef8584dbe1ee2274
SHA1

2b2e07e005541630233765ecb859cccbdbd56ee5
SHA256

1cd2dce18028036d0f435bd254e34935fad7d807ae8f1c839e0ee02e39f01e9c
SHA512

279739923da3737e52409accf8d1ec0c77dd04f22024e5085df21862b48cd43d58d04245b0478656a741beb6263b4124a5325c9b544762b1164e59783522c656
SSDEEP

3072:SdYmD7K3AC7+n+xGPdFOV8LNXZbjZCALGTGqu:spC7++J8LNNZnLV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2988	tt.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\tt.exe	1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	2988	WerFault.exe	28

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2928	1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2988	2928	1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe	28
PID 2928 wrote to memory of 2988	2928	1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe	28
PID 2928 wrote to memory of 2988	2928	1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe	28
PID 2928 wrote to memory of 2988	2928	1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2640	2988	tt.exe	29
PID 2988 wrote to memory of 2640	2988	tt.exe	29
PID 2988 wrote to memory of 2640	2988	tt.exe	29
PID 2988 wrote to memory of 2640	2988	tt.exe	29

C:\Users\Admin\AppData\Local\Temp\1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\tt.exe
  "C:\Windows\tt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 36
    3⤵
    - Program crash
    PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tt.exe

Filesize
100KB

MD5
f418e918a9df814aa25a5245b90562bb

SHA1
fe54478fad07126a1d3c0b5c19f7cfe277fa83c9

SHA256
33c2db389a4330f5f811061a19b7d4f6f0a3afdbca9da111379cb50220883511

SHA512
a7a673769e45b8fab6e04f97ef41462172ce241a507c722108ffe45676448989cba4a65382f5272132e942695ba8745bca024b7d72e1d28385eb04dcfc6f3d8c

Download Submit
memory/2928-0-0x0000000000400000-0x000000000041C200-memory.dmp

Filesize
112KB

Download
memory/2928-9-0x0000000002920000-0x0000000002953000-memory.dmp

Filesize
204KB

Download
memory/2928-8-0x0000000002920000-0x0000000002953000-memory.dmp

Filesize
204KB

Download
memory/2928-11-0x0000000000400000-0x000000000041C200-memory.dmp

Filesize
112KB

Download
memory/2928-13-0x0000000002920000-0x0000000002953000-memory.dmp

Filesize
204KB

Download
memory/2988-10-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download