1c901d915b50c5663813346bd7df1097549230f2cd01a28117b69e51e4ae29d6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
Size

14KB
MD5

2f2dac719cf3ead013c54cccc877f41b
SHA1

f46280f1b37d1d1203333129a7f8a6fe89b7a951
SHA256

1c901d915b50c5663813346bd7df1097549230f2cd01a28117b69e51e4ae29d6
SHA512

617c6100207b1693d474981e3d75781b80a7919779e63df460a93daadc08d3fed20db25076b6a9902b647a007d8ddba24c8b144381b80fa84c183e37340bf5f1
SSDEEP

384:mtJJDq0U0h0RhOIs9p5JWTFpjs1EgZc8HkvbCKB+buY:mxYZRcITFO1EvbC0quY

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\X:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\Z:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\G:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\K:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\L:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\S:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\T:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\U:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\V:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\W:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\M:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\P:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\R:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\E:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\Y:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\N:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\Q:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\H:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\I:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened (read-only)	\??\J:	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorer.ext	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
File opened for modification	C:\Windows\Tasks\explorer.ext	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1188	1428	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1428	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
1428	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
1428	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
1428	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1428	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f2dac719cf3ead013c54cccc877f41b_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 968
  2⤵
  - Program crash
  PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 1428 -ip 1428
1⤵
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads