87cae349c706841c247822d1f84264a960c9cf98ab614c00d12db227b1c8c621

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35ba9a463f0cc010bdb2e790d7c7482d_JaffaCakes118.exe
Size

3.1MB
MD5

35ba9a463f0cc010bdb2e790d7c7482d
SHA1

891f4bc2c023d822a6442380f4915b7af85e98ba
SHA256

87cae349c706841c247822d1f84264a960c9cf98ab614c00d12db227b1c8c621
SHA512

ffc44d28c8c168155cb298f3fc6c0127f86156157667276061f8fa12d42fc8abe10145f50b9bfc1a386a9b2cd118db1a41456f8072396246df152dde754d4076
SSDEEP

98304:++fsW1p1B686nvVhG6GMFiaB8v/OKGnndD82XbVAk0y:/pUnvLdFwm9K2qkt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2536	sexys103.exe_tmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Shakira Sexy Hot Screensaver Uninstaller.exe	35ba9a463f0cc010bdb2e790d7c7482d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2536	2208	35ba9a463f0cc010bdb2e790d7c7482d_JaffaCakes118.exe	85
PID 2208 wrote to memory of 2536	2208	35ba9a463f0cc010bdb2e790d7c7482d_JaffaCakes118.exe	85
PID 2208 wrote to memory of 2536	2208	35ba9a463f0cc010bdb2e790d7c7482d_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\35ba9a463f0cc010bdb2e790d7c7482d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35ba9a463f0cc010bdb2e790d7c7482d_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\inst240623953\installer\sexys103.exe_tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\inst240623953\installer\sexys103.exe_tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\inst240623953\installer\sexys103.exe_tmp.exe

Filesize
2.6MB

MD5
6240f1b3168e0a0006b6e89633dcc1d5

SHA1
6efc5f098401146f51119079be301be75908bc84

SHA256
8fb150d021048896f29e713167b5ef8060728ad23308f0cdfec049e42583e3bc

SHA512
2b90d627a2c3bac80cce813f964f7f3a6ef0fbb7d132c33af8c45773b2e73a92799c54a69a15e0a111fa1b25865c9a93d373963f7c9c6512ac1c33e0f000ba5e

Download Submit