Analysis

  • max time kernel
    95s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2024, 17:34

General

  • Target

    3e40154affb19fe173f03b0597e97466_JaffaCakes118.exe

  • Size

    167KB

  • MD5

    3e40154affb19fe173f03b0597e97466

  • SHA1

    ccfde1b9ce4aee82358265c39b996f6ea98382e0

  • SHA256

    91195117032bb0a903d11a317f86afe58c663f0fcdc6e66c47e799ddf81aefd7

  • SHA512

    fbf054673ea77d52cb63fc7b845c743dfde6a7eb1ea26cf3c1900cb8786ce26189402b04c94980072ccdd05dd89f08ca1b4ecc8abcf6026577e07db363f5f5b7

  • SSDEEP

    3072:7rJroPOWrX39HF2SWJatD062KzhfSJOtVKodSFHBvCpBMk:7rJromwJF2SmYDPkJOTdSl+

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e40154affb19fe173f03b0597e97466_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3e40154affb19fe173f03b0597e97466_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    PID:3324

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

  • memory/3324-0-0x00007FF90DC90000-0x00007FF90DE85000-memory.dmp

    Filesize

    2.0MB