3b6bbff169cce997925e2de313fb1504b63ee6761a7bde3ac1fe130246842d89

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe
Size

890KB
MD5

1c3131d79545253f75c15fdc20ba9ed0
SHA1

223b62ebf976b4579f20e10da127ee64da0d47be
SHA256

3b6bbff169cce997925e2de313fb1504b63ee6761a7bde3ac1fe130246842d89
SHA512

5a26c638613db5cc1c3655575656f413c8dffcd0cb512e481c174398142093b28025791205e7204d67603944e05404fc9efb3febc93ad1848d0f931397f083cf
SSDEEP

24576:dRmJkcoQricOIQxiZY1iaySZsF7iEM+InKf:SJZoQrbTFZY1iaySZIiEM+I4

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2136 set thread context of 1676	2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe
2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe
2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe
2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe
2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1676	2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe	28
PID 2136 wrote to memory of 1676	2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe	28
PID 2136 wrote to memory of 1676	2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe	28
PID 2136 wrote to memory of 1676	2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe	28
PID 2136 wrote to memory of 1676	2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe	28
PID 2136 wrote to memory of 1676	2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe	28
PID 2136 wrote to memory of 1676	2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe	28
PID 2136 wrote to memory of 1676	2136	1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1c3131d79545253f75c15fdc20ba9ed0_JaffaCakes118.exe"
  2⤵
  PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1676-8-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1676-6-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1676-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1676-2-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1676-10-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1676-11-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1676-12-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download