001f5dd87ded03e40998f7aae5e991a11366ec05090098bf5aee1d7d6a696b17

Analysis

max time kernel
125s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28306eda092a823e2e84a58bc9671377_JaffaCakes118.exe
Size

3.0MB
MD5

28306eda092a823e2e84a58bc9671377
SHA1

f853208c8a5a535a601fe13da1066ace009aea93
SHA256

001f5dd87ded03e40998f7aae5e991a11366ec05090098bf5aee1d7d6a696b17
SHA512

8f1cc16cc94de2fc583e34b5832cf290843087a9813af8d916015f48fcca98b08031c3013e69cbd2d09614ef8565d0dd278dceb2ba03fb8b9a19ea87a67b335f
SSDEEP

98304:++fh1p1B6k64aDNIKsb2Rg8JBei3bOTbZBlPoub:lpM5xmb2QXTdXt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2440	sexyss74.exe_tmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Sarah Michelle Gellar Sex-E Screensaver Uninstaller.exe	28306eda092a823e2e84a58bc9671377_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 2440	5020	28306eda092a823e2e84a58bc9671377_JaffaCakes118.exe	92
PID 5020 wrote to memory of 2440	5020	28306eda092a823e2e84a58bc9671377_JaffaCakes118.exe	92
PID 5020 wrote to memory of 2440	5020	28306eda092a823e2e84a58bc9671377_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\28306eda092a823e2e84a58bc9671377_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28306eda092a823e2e84a58bc9671377_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\inst240649328\installer\sexyss74.exe_tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\inst240649328\installer\sexyss74.exe_tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4216,i,7545522914305657361,9950105517201397946,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:8
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\inst240649328\installer\sexyss74.exe_tmp.exe

Filesize
2.3MB

MD5
e4d3450b739d1979c5b0e94d358c22a4

SHA1
13953f4f7ba06e178fe8829b765d65a37b0772bc

SHA256
be65e6d8bfb7633b98c19ddd04d54332c9c2f876ba3ff20f2639326fb0896873

SHA512
b3b9a575db1aded65a75413a851e2899b0163c7f3a2464d5743d44f3442a118420502f55a5f14c2ee9c87b6549a8fec96f0a8a9bdac07e23527f09bd31ceb7a9

Download Submit