Overview

overview

6

Static

static

3

452974bf99...18.exe

windows7-x64

6

452974bf99...18.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2024, 09:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    452974bf9936f98408f05975fb4316cb_JaffaCakes118.exe

  • Size

    44KB

  • MD5

    452974bf9936f98408f05975fb4316cb

  • SHA1

    cc0cf50a6fd548b49e9b07054ff402297c7dd634

  • SHA256

    84c5b60c6d483544694f37067a7b766c460bab497fcaaaf3fc683f642ce62dde

  • SHA512

    78e52497f2b713b7c59e542b945489eb915ee0e8d75cf1f2e572d9fda43b25986ab384bef80301b4cce03a9756ca99e495c5cde940b806877ecb4b5d9951f254

  • SSDEEP

    768:Ntxud354RB2J1TXvuNxzZ2rAB2DCFmGyfOcMFo7ZX6WurSW6LmRSq4SfxuN:NqJmB2172sfyF+6/+WFSq4x

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3504
      • C:\Users\Admin\AppData\Local\Temp\452974bf9936f98408f05975fb4316cb_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\452974bf9936f98408f05975fb4316cb_JaffaCakes118.exe"
        2⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4856
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1176
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:556

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • F:\$RECYCLE.BIN\S-1-5-21-2650514177-1034912467-4025611726-1000\_desktop.ini
              Filesize

              9B

              MD5

              0653172e5260f095c0c6fad564e1ba48

              SHA1

              518c62542b8b9f391a7d8256f3ef5904bfb09aec

              SHA256

              1f0618cc0b0b8b83f6d023b8d27a6ce1fcd5fe097e0f86bad0c2cefac566d600

              SHA512

              4fa6d71865969fe8fc7c32ed4d9e729b3dc13fe90923edba6991b6c47b57e81544daa2efae4145ffd03a927cb4e79630e3d82c34bf516a63a06db61568cdbf3c

              Download Submit

            • memory/4856-0-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

              Download

            • memory/4856-5340-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

              Download

            • memory/4856-5691-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

              Download