d6c1eca20f2f56084e95c0f23c9ad8be616d4454e270080c2feaef28b25f96c4

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
Size

66KB
MD5

2804b901f161442cd59e94fe1d17afa8
SHA1

8637192c66bc83da3cb75c06db5c8c41d9386eb5
SHA256

d6c1eca20f2f56084e95c0f23c9ad8be616d4454e270080c2feaef28b25f96c4
SHA512

18eb4cdbb0b57429e2e891246f08b60efb5e2dae09aea438b74c9fbaf48a4fb869c5279c74e50ee8158a0189a958fefc3809ecd3cf2855cfd780bb755990061e
SSDEEP

1536:DVz5dKFhcaHZkQhBxJr/pT1w3aUZmhEKjkqyS6bnouy83q5:DVvUSQlT1w3aU8hAPSuout3+

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\X:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\G:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\N:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\S:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\V:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\J:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\L:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\P:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\T:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\D:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\E:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\F:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\H:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\I:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\M:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\O:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\Z:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\Y:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\K:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\Q:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\R:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
File opened (read-only)	\??\U:	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3920	2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2804b901f161442cd59e94fe1d17afa8_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3920-0-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3920-3-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download