4cde1fed136e841e585e6807a9aa760c1d5e9fc2aed8b0b247bcdb75c883481d

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aa8a74ba55b7721f6109370e52e969e_JaffaCakes118.exe
Size

9KB
MD5

1aa8a74ba55b7721f6109370e52e969e
SHA1

03049b29ab53c46fcf209a3d4279a6d4f371075d
SHA256

4cde1fed136e841e585e6807a9aa760c1d5e9fc2aed8b0b247bcdb75c883481d
SHA512

fd98399fbcf842bd10663fb0c5e00141aa8ec81ddd4aa9ad646324cec17f8d07cd73794373077028c1ec245b9971cbc2760413f4d6efb37321ac4012ac44ddc9
SSDEEP

96:0kVqngpc13bjk9agiB7/AQpsPLCtvb1YFmSAyfcfm0XlzjStA20an2JbIGuhP5I0:0O9cFbo9PctKCvmozacfTBP0P5Ilad9

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2832	quip.exe

Loads dropped DLL 2 IoCs

pid	Process
2468	1aa8a74ba55b7721f6109370e52e969e_JaffaCakes118.exe
2468	1aa8a74ba55b7721f6109370e52e969e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2832	2468	1aa8a74ba55b7721f6109370e52e969e_JaffaCakes118.exe	28
PID 2468 wrote to memory of 2832	2468	1aa8a74ba55b7721f6109370e52e969e_JaffaCakes118.exe	28
PID 2468 wrote to memory of 2832	2468	1aa8a74ba55b7721f6109370e52e969e_JaffaCakes118.exe	28
PID 2468 wrote to memory of 2832	2468	1aa8a74ba55b7721f6109370e52e969e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1aa8a74ba55b7721f6109370e52e969e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1aa8a74ba55b7721f6109370e52e969e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\quip.exe
  "C:\Users\Admin\AppData\Local\Temp\quip.exe"
  2⤵
  - Executes dropped EXE
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8DF4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\quip.exe

Filesize
10KB

MD5
7aa756fea97390e314fcd27c44d8c2f2

SHA1
9e504b960c7c12a0f55265722417ae6d49fa3cc7

SHA256
654abff88b077c7c58e1267fc7bdcc2262aa027e39220861f719acb96e78240a

SHA512
f6a9cf41deb7b4675c3fe1f0d7031c0e2b0e65bcea0154925a4d5ca1833a65b34a3a8908c5f35c1dfcb17cd939c241b635fcb0bf108765caaae684e0f6b04f94

Download Submit
memory/2468-1-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2832-11-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download