d0a06c4321e61222cb05ed34f94b4fc1f67af12e95b70491ddebe302aa73cda7

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe
Size

2.5MB
MD5

3b5cf58381590090ab9efc3142f0e759
SHA1

2ac29f3412f10bdaa37e654fcad40694debf1f05
SHA256

d0a06c4321e61222cb05ed34f94b4fc1f67af12e95b70491ddebe302aa73cda7
SHA512

f239d4a9ff8231c0cfcd8b2e3b987218570fffae405610ea69399f904bb4f2f79d6fdcae6fe82d551ae2db7c0635145fbd45d2feab231c121af5e71a150eb15b
SSDEEP

49152:A2dI65r9DArs5bh12JKCuC27Lf/nbphfg9N4ADDrIsy/SB8iRQLvDNbt:tq6d5A4dXQKT7LTfg9X//yqB8iy/n

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
492	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.tmp

Loads dropped DLL 3 IoCs

pid	Process
1948	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe
492	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.tmp
492	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
492	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 492	1948	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe	30
PID 1948 wrote to memory of 492	1948	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe	30
PID 1948 wrote to memory of 492	1948	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe	30
PID 1948 wrote to memory of 492	1948	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe	30
PID 1948 wrote to memory of 492	1948	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe	30
PID 1948 wrote to memory of 492	1948	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe	30
PID 1948 wrote to memory of 492	1948	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\is-4PE8O.tmp\3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4PE8O.tmp\3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.tmp" /SL5="$50152,2347147,64000,C:\Users\Admin\AppData\Local\Temp\3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-4PE8O.tmp\3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.tmp

Filesize
679KB

MD5
b8549f0419de4a97bbfbdd17b2c8ccc0

SHA1
fe64cfb9800edd5a4b371a73785bd42691f99015

SHA256
41fb6e4d99a16ab71afb641654df2d5fde413da433514e2e0abf9977904320fa

SHA512
054b6a93deebe5c484b5b607059119bdbd0fe9ed7a5c37e608f1e3a49f54168845755daf8af34d74b0f6f4673ca869b0ede039d5b270fdd03d92a994789ca7b7

Download Submit
\Users\Admin\AppData\Local\Temp\is-QD8M5.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/492-16-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/492-18-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/1948-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1948-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1948-17-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download