d0a06c4321e61222cb05ed34f94b4fc1f67af12e95b70491ddebe302aa73cda7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe
Size

2.5MB
MD5

3b5cf58381590090ab9efc3142f0e759
SHA1

2ac29f3412f10bdaa37e654fcad40694debf1f05
SHA256

d0a06c4321e61222cb05ed34f94b4fc1f67af12e95b70491ddebe302aa73cda7
SHA512

f239d4a9ff8231c0cfcd8b2e3b987218570fffae405610ea69399f904bb4f2f79d6fdcae6fe82d551ae2db7c0635145fbd45d2feab231c121af5e71a150eb15b
SSDEEP

49152:A2dI65r9DArs5bh12JKCuC27Lf/nbphfg9N4ADDrIsy/SB8iRQLvDNbt:tq6d5A4dXQKT7LTfg9X//yqB8iy/n

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4200	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4200	4636	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe	84
PID 4636 wrote to memory of 4200	4636	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe	84
PID 4636 wrote to memory of 4200	4636	3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\is-5MT8K.tmp\3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5MT8K.tmp\3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.tmp" /SL5="$80050,2347147,64000,C:\Users\Admin\AppData\Local\Temp\3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-5MT8K.tmp\3b5cf58381590090ab9efc3142f0e759_JaffaCakes118.tmp

Filesize
679KB

MD5
b8549f0419de4a97bbfbdd17b2c8ccc0

SHA1
fe64cfb9800edd5a4b371a73785bd42691f99015

SHA256
41fb6e4d99a16ab71afb641654df2d5fde413da433514e2e0abf9977904320fa

SHA512
054b6a93deebe5c484b5b607059119bdbd0fe9ed7a5c37e608f1e3a49f54168845755daf8af34d74b0f6f4673ca869b0ede039d5b270fdd03d92a994789ca7b7

Download Submit
memory/4200-10-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/4200-14-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/4636-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4636-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4636-13-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download