b1f51e30141edf5352f6f73af725eab58c911d49e88391580bfbdf0a77bcf2bc

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a08b0e9b852376736a3fa0180786a79_JaffaCakes118.exe
Size

978KB
MD5

3a08b0e9b852376736a3fa0180786a79
SHA1

fc3eeeecfa271b86b3bf3526fe2b7ce5493a7ead
SHA256

b1f51e30141edf5352f6f73af725eab58c911d49e88391580bfbdf0a77bcf2bc
SHA512

cf0e861492fc6b98b51ba3a1bad232f5b1cbb5da9ee1bca93dea6f7089e7f0309e60b48b5604cdb2a56331af57da585818db1e12e131240626ce1e43501d5cd7
SSDEEP

12288:R6SKqT31T6WpJY6V765jKqostkm3Ob6rRyOsDqg1W:AxqT31T6WE6I5jKqosOm+bEes

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4656	4772	3a08b0e9b852376736a3fa0180786a79_JaffaCakes118.exe	86
PID 4772 wrote to memory of 4656	4772	3a08b0e9b852376736a3fa0180786a79_JaffaCakes118.exe	86
PID 4772 wrote to memory of 4656	4772	3a08b0e9b852376736a3fa0180786a79_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\3a08b0e9b852376736a3fa0180786a79_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a08b0e9b852376736a3fa0180786a79_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\s.cmd
  2⤵
  PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\s.cmd

Filesize
249B

MD5
4ff0799c031322e215a2d8a89e6ca093

SHA1
b96f179717405a330eed695df7607244c449a9dd

SHA256
5dcf332eb100a2356eb549e500b0b47b325d0f5b79cd5124d0c49c3f5f8829f1

SHA512
60654c8bd732edd6a7755aa793dbe34a7704a584ffb316b7a9b0f9d09d99899fa87beaa3f3c1cb92f52157e21589d7860cec90e40d4c71d9fd0632c385c57b24

Download Submit