45e86b9fd2e697277a59604d57732bf2798579834580e98ece613b59d1db2b39

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 11:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d1ea782ef4d6b862728af307283fc0d_JaffaCakes118.exe
Size

52KB
MD5

3d1ea782ef4d6b862728af307283fc0d
SHA1

8ad420d4b335f542c8ce07b480343b48f37acc87
SHA256

45e86b9fd2e697277a59604d57732bf2798579834580e98ece613b59d1db2b39
SHA512

765c78d766ae2c9be89116d0fc5b7497e9ab03490d6b78a2f4ece8dd173007a0d5709ed929934a6fdd0c861b790b05ccc13a24821cbf06d04549d680abb2ca72
SSDEEP

768:kb2XwxV4XekFdZj//1pN1/I8KLP1Y0nXiHWxQRig/0CjXek0xV1X:G2X66Xeqdd/nPTKzOkqZjXeFHX

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	3d1ea782ef4d6b862728af307283fc0d_JaffaCakes118.exe
File opened (read-only)	\??\D:	3d1ea782ef4d6b862728af307283fc0d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4636	3d1ea782ef4d6b862728af307283fc0d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3d1ea782ef4d6b862728af307283fc0d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d1ea782ef4d6b862728af307283fc0d_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4636-2-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download