0b6e4562d7f25fd323c80b71eb8e8962b7f0b5de0efd477bf38d95c40765898c

Analysis

max time kernel
118s
max time network
138s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a3dfcd6f8aa9355efa8e6682a80d271_JaffaCakes118.exe
Size

108KB
MD5

3a3dfcd6f8aa9355efa8e6682a80d271
SHA1

b928f58456112586406e3a401c805a6e3a0f8f12
SHA256

0b6e4562d7f25fd323c80b71eb8e8962b7f0b5de0efd477bf38d95c40765898c
SHA512

c8cc36d1a3916d4640abd04e02ea136b15c0e766c2c3c914b122c121f99b69b7c46ebe7137dbf359622180af0b7d88f2a62eee3140d02116aa68a5e7b9f46f3b
SSDEEP

3072:foTBPyodxmU3mK3zc+ltBbvnR4ts3KHGaHg9OyF2mkkMJW6P2NO:foVP9xmU3mK3zc+ltBbvnR4ts3KHGaH8

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2340	muauleb.exe

Loads dropped DLL 2 IoCs

pid	Process
2492	3a3dfcd6f8aa9355efa8e6682a80d271_JaffaCakes118.exe
2492	3a3dfcd6f8aa9355efa8e6682a80d271_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2492	3a3dfcd6f8aa9355efa8e6682a80d271_JaffaCakes118.exe
2340	muauleb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2340	2492	3a3dfcd6f8aa9355efa8e6682a80d271_JaffaCakes118.exe	30
PID 2492 wrote to memory of 2340	2492	3a3dfcd6f8aa9355efa8e6682a80d271_JaffaCakes118.exe	30
PID 2492 wrote to memory of 2340	2492	3a3dfcd6f8aa9355efa8e6682a80d271_JaffaCakes118.exe	30
PID 2492 wrote to memory of 2340	2492	3a3dfcd6f8aa9355efa8e6682a80d271_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3a3dfcd6f8aa9355efa8e6682a80d271_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a3dfcd6f8aa9355efa8e6682a80d271_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\muauleb.exe
  "C:\Users\Admin\muauleb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\muauleb.exe

Filesize
108KB

MD5
4896056b50c86728fd168a433d77dcf4

SHA1
afd060781128632d1e14f0b6c8be5189b82dc93e

SHA256
6ab10f416afa844d5c7ab49020a25ea477ac1668fb21a90c4b504fe3ee57619c

SHA512
2595aa409021325f057ff8e7a3848f556f1545c6065cd845052404bea535e7d4af21e6643f94dfb01dcc4fbc6c905b98bb1fc018a23598fd1352e3be814effb8

Download Submit