356e45460bd8c101b1bc7254f775abecb08a205365c3277d0f734f6cf6f20e52

Analysis

max time kernel
149s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe
Size

36KB
MD5

3a0cfd1cac612ec51c9f8019bebb75ed
SHA1

987ebba15f6dc8c99bff7aad26a3cc13c02fa736
SHA256

356e45460bd8c101b1bc7254f775abecb08a205365c3277d0f734f6cf6f20e52
SHA512

39a71d74c335370053903f6c4cd70ccfc6694ceaed464953ec25a202c4de0ce3661251186bc88c1fdca9cc9c01b8307c152c2aaf57b701a00da3dc759f81b975
SSDEEP

384:MU1LS3HJBqn1NpwM7I4YauAncwdpOmzwgZVmWa8mfetDysSfDlI:HS3H/K1N29somN39z2

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1920	IEHelp.exe

Loads dropped DLL 5 IoCs

pid	Process
2528	3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe
1920	IEHelp.exe
1920	IEHelp.exe
1920	IEHelp.exe
1920	IEHelp.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\IEHelp.exe	3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\IEHelp.exe	3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2528	3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe
1920	IEHelp.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1920	2528	3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe	29
PID 2528 wrote to memory of 1920	2528	3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe	29
PID 2528 wrote to memory of 1920	2528	3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe	29
PID 2528 wrote to memory of 1920	2528	3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe	29
PID 2528 wrote to memory of 1920	2528	3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe	29
PID 2528 wrote to memory of 1920	2528	3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe	29
PID 2528 wrote to memory of 1920	2528	3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a0cfd1cac612ec51c9f8019bebb75ed_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEHelp.exe
  "C:\Program Files (x86)\Internet Explorer\IEHelp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\at.lnk

Filesize
973B

MD5
2fcd601acc224f2b3408ff1bd182f555

SHA1
be6cc02c33334922887f530cdfc24bed459081dd

SHA256
ee5cb077d0f515539d1fb0f03a18e9a356dca1cc4a121f691f142bed3abbf049

SHA512
f00d07be26330bb3fce1df4d2505f32fdde15ae31fd8c2df935a3f93c3dd805e545d5bd5bfab5607d3f26669e1f1098613aa6c75a307a4ec8d4077af13c86855

Download Submit
\Program Files (x86)\Internet Explorer\IEHelp.exe

Filesize
36KB

MD5
3a0cfd1cac612ec51c9f8019bebb75ed

SHA1
987ebba15f6dc8c99bff7aad26a3cc13c02fa736

SHA256
356e45460bd8c101b1bc7254f775abecb08a205365c3277d0f734f6cf6f20e52

SHA512
39a71d74c335370053903f6c4cd70ccfc6694ceaed464953ec25a202c4de0ce3661251186bc88c1fdca9cc9c01b8307c152c2aaf57b701a00da3dc759f81b975

Download Submit