c627ab2a1b1d6ec882f8e33972b34530974dc4b953cc347c517db2b924e275f7

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
Size

726KB
MD5

1a203b8b119dc8205871fed951971e7a
SHA1

0ef83882e3e96446b446e0295304b653cb87ca6b
SHA256

c627ab2a1b1d6ec882f8e33972b34530974dc4b953cc347c517db2b924e275f7
SHA512

b566d1b68704701de31ed4e9546c96f60ca38d9bbf81894d64d3653bd70b0e706b3d2d1c1494bd703dc9cfc485b7fb6b87ac6ca902e21a3e2099f7154a46382d
SSDEEP

12288:jXyQ/JBFMheooeChcG4VpuwCWQcUl+gvHZGBMTaN+562HgSJatdUvJjbYXNWB8E9:jiipooeOk31Ul+8HgB+1mQJjiWi1sf

Score

5^/10

Malware Config

Signatures

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\e:\autorun.inf	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	\??\f:\autorun.inf	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	\??\g:\autorun.inf	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	\??\c:\autorun.inf	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	\??\d:\autorun.inf	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\1.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\1.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process
PID 2376 set thread context of 0	2376	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\1.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	C:\Program Files\1.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\WINDOWS\1.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\1.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File created	C:\WINDOWS\2.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\2.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2376	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process
PID 2376 wrote to memory of 0	2376	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
PID 2376 wrote to memory of 0	2376	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
PID 2376 wrote to memory of 0	2376	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
PID 2376 wrote to memory of 0	2376	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe"
1⤵
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F:\1.exe

Filesize
726KB

MD5
1a203b8b119dc8205871fed951971e7a

SHA1
0ef83882e3e96446b446e0295304b653cb87ca6b

SHA256
c627ab2a1b1d6ec882f8e33972b34530974dc4b953cc347c517db2b924e275f7

SHA512
b566d1b68704701de31ed4e9546c96f60ca38d9bbf81894d64d3653bd70b0e706b3d2d1c1494bd703dc9cfc485b7fb6b87ac6ca902e21a3e2099f7154a46382d

Download Submit
memory/2376-15-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2376-40-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2376-7-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2376-6-0x0000000000401000-0x00000000004C7000-memory.dmp

Filesize
792KB

Download
memory/2376-8-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2376-9-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2376-2-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2376-0-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2376-14-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2376-39-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2376-1-0x00000000006A0000-0x00000000006A4000-memory.dmp

Filesize
16KB

Download
memory/2376-42-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2376-41-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2376-45-0x00000000006A0000-0x00000000006A4000-memory.dmp

Filesize
16KB

Download
memory/2376-46-0x0000000000401000-0x00000000004C7000-memory.dmp

Filesize
792KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads