Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 05:42

General

  • Target

    33834955eb80ee28aa9fe2931d623e84_JaffaCakes118.exe

  • Size

    21KB

  • MD5

    33834955eb80ee28aa9fe2931d623e84

  • SHA1

    2574424bf7368f21169757428fc6162cfc7a1147

  • SHA256

    cc630c8ee16a8120e9568e4dabc89ea7b454b8dbf27ef396937c4e87b62d6083

  • SHA512

    05f3f1fefd2ce7c072e0e1bd53135d11a915a586e4434778a98bfb3be8937ddabf450d758e4a051432ec41d029fbf43841a29b354bbc822fcf56be33533cf889

  • SSDEEP

    384:JL7eRw68dGH1YOgHWZRLf4jm9XFfSvHlYc35X:Z7eRVSGGHMFi7d

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 2 IoCs
  • Drops autorun.inf file 1 TTPs 5 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

Processes

  • C:\Users\Admin\AppData\Local\Temp\33834955eb80ee28aa9fe2931d623e84_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\33834955eb80ee28aa9fe2931d623e84_JaffaCakes118.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    PID:4740

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • F:\autorun.inf

          Filesize

          49B

          MD5

          c34e77f4fe1d7e108fa8a46f4df6e3ed

          SHA1

          411843890edeb02c9d94d2bd9cbd29765d4a6294

          SHA256

          d6deb4bcead9994f02dba5fa81fa005fde8a36876be0a0620f2ea4e2ad4cf765

          SHA512

          990c9ecc888a5e6d5b8526d31666872bbe9581a9f9ae359537a4e0c3847925a786937868f43c9eea30fd752ddd6a5667007a8074c1412729a78edf1bd3aae0f3

        • F:\greedy.exe

          Filesize

          21KB

          MD5

          33834955eb80ee28aa9fe2931d623e84

          SHA1

          2574424bf7368f21169757428fc6162cfc7a1147

          SHA256

          cc630c8ee16a8120e9568e4dabc89ea7b454b8dbf27ef396937c4e87b62d6083

          SHA512

          05f3f1fefd2ce7c072e0e1bd53135d11a915a586e4434778a98bfb3be8937ddabf450d758e4a051432ec41d029fbf43841a29b354bbc822fcf56be33533cf889

        • memory/4740-9-0x00007FFA6D280000-0x00007FFA6DC21000-memory.dmp

          Filesize

          9.6MB

        • memory/4740-10-0x00007FFA6D280000-0x00007FFA6DC21000-memory.dmp

          Filesize

          9.6MB

        • memory/4740-4-0x000000001C450000-0x000000001C4EC000-memory.dmp

          Filesize

          624KB

        • memory/4740-5-0x00007FFA6D280000-0x00007FFA6DC21000-memory.dmp

          Filesize

          9.6MB

        • memory/4740-6-0x00000000010E0000-0x00000000010E8000-memory.dmp

          Filesize

          32KB

        • memory/4740-7-0x000000001C5F0000-0x000000001C63C000-memory.dmp

          Filesize

          304KB

        • memory/4740-0-0x00007FFA6D535000-0x00007FFA6D536000-memory.dmp

          Filesize

          4KB

        • memory/4740-3-0x000000001BEE0000-0x000000001C3AE000-memory.dmp

          Filesize

          4.8MB

        • memory/4740-11-0x00007FFA6D535000-0x00007FFA6D536000-memory.dmp

          Filesize

          4KB

        • memory/4740-12-0x00007FFA6D280000-0x00007FFA6DC21000-memory.dmp

          Filesize

          9.6MB

        • memory/4740-13-0x00007FFA6D280000-0x00007FFA6DC21000-memory.dmp

          Filesize

          9.6MB

        • memory/4740-14-0x00007FFA6D280000-0x00007FFA6DC21000-memory.dmp

          Filesize

          9.6MB

        • memory/4740-2-0x00007FFA6D280000-0x00007FFA6DC21000-memory.dmp

          Filesize

          9.6MB

        • memory/4740-1-0x000000001B8B0000-0x000000001B956000-memory.dmp

          Filesize

          664KB