f0c01fa19727182c541015dc1ecad934c54f63cbd27c9773b25ff941b8d41f32

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4be13aa021ff2e8b258ba6d75bdb52aa_JaffaCakes118.exe
Size

3.1MB
MD5

4be13aa021ff2e8b258ba6d75bdb52aa
SHA1

2d3224de8f8ca70e6ddee80393d6bc4a0ec7d866
SHA256

f0c01fa19727182c541015dc1ecad934c54f63cbd27c9773b25ff941b8d41f32
SHA512

90510961ad16cae7cc1718507c0aebb83567822315c2f4b3520099cc8461e6273b0257da3e6b91e7f6c6fbcd633def5b823fa2b68d8d9c5be64ffa04a6dc6ca9
SSDEEP

49152:OQUBMUK6392LZwfP8aTdONnZsAClSxLnnroG5fiH1FbVxoUJMee69VpVZJ0w:OPBMRI2LZwfhTpACQxLRYH1F8eTTzJ0w

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2704	CamPlay.exe

Loads dropped DLL 2 IoCs

pid	Process
2292	4be13aa021ff2e8b258ba6d75bdb52aa_JaffaCakes118.exe
2292	4be13aa021ff2e8b258ba6d75bdb52aa_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2704	CamPlay.exe
2704	CamPlay.exe
2704	CamPlay.exe
2704	CamPlay.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2704	2292	4be13aa021ff2e8b258ba6d75bdb52aa_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2704	2292	4be13aa021ff2e8b258ba6d75bdb52aa_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2704	2292	4be13aa021ff2e8b258ba6d75bdb52aa_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2704	2292	4be13aa021ff2e8b258ba6d75bdb52aa_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\4be13aa021ff2e8b258ba6d75bdb52aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4be13aa021ff2e8b258ba6d75bdb52aa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\_Sfx025\CamPlay.exe
  "C:\Users\Admin\AppData\Local\Temp\_Sfx025\CamPlay.exe" /play "C:\Users\Admin\AppData\Local\Temp\_Sfx025\SW048.avi"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_Sfx025\SW048.avi

Filesize
4.6MB

MD5
8ec32367017c20c7cbfe10323a476846

SHA1
9bc2d418ccac8d81c32fff77ee19188624731f4f

SHA256
59875c9abc258c79bab474d9d7991ce46395ff56e4d6c950ad9eff9ee50f9c9f

SHA512
0caf9536698c3432e9333e1c94d90018b1cb78092a813f7e604a4b76dd58b550b08cc0af49e690ecd4cca11a060bd13b5abd29deada24e5f49f8066ee28cb2c9

Download Submit
\Users\Admin\AppData\Local\Temp\_Sfx025\CamPlay.exe

Filesize
380KB

MD5
9371276f596e56f9e340e4cfb384974c

SHA1
3adbf7cbdb07f9be2e8961b56a0a4b533c7259aa

SHA256
f812241bdd42e987d77d9714d08338668f4dbe1f4763a3148b86ac854dba376b

SHA512
6bdd83ba89cb54f43e4cb009fe53fe29219ce097835aaec5cb2ac19ef7c017965efdf83e3fe9489ae91a0a2592305c8bbfe6be27241e86fabf71d3cf6b28b508

Download Submit