6ffbbad4cd83e3d56de809fc194389429fce6bc4560f56c009cb1242e65896c0

Analysis

max time kernel
124s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48b3888b9d9a4ff033a37a0be8fd1391_JaffaCakes118.exe
Size

270KB
MD5

48b3888b9d9a4ff033a37a0be8fd1391
SHA1

de1e8ac2d3e8f86b19fe2fd9f15566ee8dc63f09
SHA256

6ffbbad4cd83e3d56de809fc194389429fce6bc4560f56c009cb1242e65896c0
SHA512

51177dc209a1a083dd6aadebfc749a011caea32a499caf5f76a488831ffb443569be4184d15446688f2996c9edaee3a867d7a1e96e5a5d710fc2f670793ad9b2
SSDEEP

6144:HPZpP5xaPySS5i0plx8LLSpGfgqWDQQ67nTeQnF+GzjDEFRQXna:vZpP5YS5hplcSpGfg5QrTxl4cXna

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3376	vmwaretools.exe

Executes dropped EXE 1 IoCs

pid	Process
3376	vmwaretools.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3376	vmwaretools.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 2040	3376	vmwaretools.exe	87
PID 3376 wrote to memory of 2040	3376	vmwaretools.exe	87

C:\Users\Admin\AppData\Local\Temp\48b3888b9d9a4ff033a37a0be8fd1391_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\48b3888b9d9a4ff033a37a0be8fd1391_JaffaCakes118.exe"
1⤵
PID:2612

C:\Program Files (x86)\Vmware\vmwaretools.exe
"C:\Program Files (x86)\Vmware\vmwaretools.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" %1
  2⤵
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Vmware\vmwaretools.exe

Filesize
270KB

MD5
48b3888b9d9a4ff033a37a0be8fd1391

SHA1
de1e8ac2d3e8f86b19fe2fd9f15566ee8dc63f09

SHA256
6ffbbad4cd83e3d56de809fc194389429fce6bc4560f56c009cb1242e65896c0

SHA512
51177dc209a1a083dd6aadebfc749a011caea32a499caf5f76a488831ffb443569be4184d15446688f2996c9edaee3a867d7a1e96e5a5d710fc2f670793ad9b2

Download Submit
memory/2612-0-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2612-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2612-2-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/2612-9-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/3376-7-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/3376-8-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/3376-11-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3376-10-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/3376-12-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download