2bc284db54689ba73be757dc91801b82f7d151d3e5ee43e10fbc3505f5a1e07e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
Size

2.3MB
MD5

42f9773654dac6d1d881c76e34ce4ac2
SHA1

982fb5a846b503c4782f3161bccee3ae7532cd10
SHA256

2bc284db54689ba73be757dc91801b82f7d151d3e5ee43e10fbc3505f5a1e07e
SHA512

87b6dc6cf5fd7a2d3f4117a25b8f820f30f4737e53d3175cfb7b9de061d208d8ed0f24d440fdde496361b84aa5e5724cf1ff1bb7bc93aea041f50fb741b665c6
SSDEEP

49152:ENq3xasXVW3cfMRi26BZG1X69gNf8yjLHaR4PZEZRDDvz7H:Ek3tCaqu8O28+64Zu9DH

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\X:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\Y:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\Z:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\E:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\I:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\Q:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\O:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\P:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\R:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\V:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\B:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\K:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\L:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\M:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\S:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\U:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\A:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\H:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\J:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\G:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\N:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
File opened (read-only)	\??\T:	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1540	2340	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe	30
PID 2340 wrote to memory of 1540	2340	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe	30
PID 2340 wrote to memory of 1540	2340	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe	30
PID 2340 wrote to memory of 1540	2340	42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\42f9773654dac6d1d881c76e34ce4ac2_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\~RomDmp1RomDump.com > C:\Users\Admin\AppData\Local\Temp\~RomDmp1Rom.dmp
  2⤵
  PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2340-0-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2340-2-0x00000000042C0000-0x00000000042C1000-memory.dmp

Filesize
4KB

Download
memory/2340-6-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download