96824f50a8438d0ced4be3dd26906c4c2babcd3e3d1f5b41619a2d33f887546a

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b5e1e92dff4ddaff66c8de343b65c0a_JaffaCakes118.exe
Size

366KB
MD5

1b5e1e92dff4ddaff66c8de343b65c0a
SHA1

ddd735847d2f5cb236614aab4a39f27181e80b9a
SHA256

96824f50a8438d0ced4be3dd26906c4c2babcd3e3d1f5b41619a2d33f887546a
SHA512

9877dadb955c9447524c0ffcb83e9317ea6e8ed7a268c2a1d93df1d2667348f337e0b036f516ca4aeb6ee7b655d55c54450c3ae506abecd007068c434e74973f
SSDEEP

6144:mK6jZ91YlxB3OPIzkWmQOn0KwNarSlKxJR+v6NZgCwj87N:mFGlxBePIzkWmQDKwNA8wz+v6NZyj87N

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2216	calcs.exe

Loads dropped DLL 2 IoCs

pid	Process
2268	1b5e1e92dff4ddaff66c8de343b65c0a_JaffaCakes118.exe
2268	1b5e1e92dff4ddaff66c8de343b65c0a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2216	2268	1b5e1e92dff4ddaff66c8de343b65c0a_JaffaCakes118.exe	28
PID 2268 wrote to memory of 2216	2268	1b5e1e92dff4ddaff66c8de343b65c0a_JaffaCakes118.exe	28
PID 2268 wrote to memory of 2216	2268	1b5e1e92dff4ddaff66c8de343b65c0a_JaffaCakes118.exe	28
PID 2268 wrote to memory of 2216	2268	1b5e1e92dff4ddaff66c8de343b65c0a_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1b5e1e92dff4ddaff66c8de343b65c0a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b5e1e92dff4ddaff66c8de343b65c0a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\calcs.exe
  "C:\Users\Admin\AppData\Local\Temp\calcs.exe"
  2⤵
  - Executes dropped EXE
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\calcs.exe

Filesize
112KB

MD5
829e4805b0e12b383ee09abdc9e2dc3c

SHA1
5a272b7441328e09704b6d7eabdbd51b8858fde4

SHA256
37121ecb7c1e112b735bd21b0dfe3e526352ecb98c434c5f40e6a2a582380cdd

SHA512
356fe701e6788c9e4988ee5338c09170311c2013d6b72d7756b7ada5cda44114945f964668feb440d262fb1c0f9ca180549aafd532d169ceeadf435b9899c8f6

Download Submit
memory/2268-9-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download