706976bd0f59639fe79dd4ca020f3e258211b8997070cd65dda37ddc89a7d6b6

Analysis

max time kernel
125s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2daedf3ac9c59fe508408804b91e0a2a_JaffaCakes118.exe
Size

539KB
MD5

2daedf3ac9c59fe508408804b91e0a2a
SHA1

797bbc0db311f40b835e756cf5fa47c4c55b2764
SHA256

706976bd0f59639fe79dd4ca020f3e258211b8997070cd65dda37ddc89a7d6b6
SHA512

a47a0d79da1e5eaa779d8eedcc8a24252c003832479d91bb3915e87373f0c017b8f80e3846214dccc163b8c33ed71e66ad8e75817492072e31e4951787341917
SSDEEP

12288:kjJF6i6D7OuOk28hwXZxBciFgiWgJpWuzqtSDL/fTz3bXAC:W5uSuOkDCZxBcegiW0pFqGTLbwC

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4088	2daedf3ac9c59fe508408804b91e0a2a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2daedf3ac9c59fe508408804b91e0a2a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2daedf3ac9c59fe508408804b91e0a2a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1304,i,6959856223548986108,4217696995639198458,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hpqdocd000.log

Filesize
346B

MD5
1bcd8591505435cf563fe9a7a80ed773

SHA1
53e4498a2c9c3af8b52e1de6aced23b48be2ff2b

SHA256
2ed2c8f96cc07282bab56256103f9ca2d3f647bec7010d4fa2e1095aca3af430

SHA512
17d4e0b03ce54f837dc0e7552838c4e9ab32909c57768823f461eb54a06ab2ceaf64d63bf5d10ebbd8e80ef56b163f45a470350486bc7663d39d818065edeef7

Download Submit
memory/4088-0-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/4088-1-0x000000000042C000-0x000000000042D000-memory.dmp

Filesize
4KB

Download
memory/4088-7-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download