c3651dac75b3e28274770cba4a96f38ee0e3083432bfb932d2d8cc43be7020bf

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
Size

275KB
MD5

4c1adaba30205de927038ba98c8387a1
SHA1

583e587c302bab841b01ef3b426bb842b2aebfe8
SHA256

c3651dac75b3e28274770cba4a96f38ee0e3083432bfb932d2d8cc43be7020bf
SHA512

9aba0048d369bd492a4a6c8611c98890b2cb67a28f85d6c0d5317eefee883d2f38754cbfbf1417ac5a190b8cdb720f1e9f8a9e2e9d68da414b8e602f8204f055
SSDEEP

6144:HxD7ORrPMzSHQTnyF3XSOZm6UNc//////cd:irPMz8IyJiIUNc//////U

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4376	kvhelper.exe

Loads dropped DLL 38 IoCs

pid	Process
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4376	kvhelper.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 4376	3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe	84
PID 3228 wrote to memory of 4376	3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe	84
PID 3228 wrote to memory of 4376	3228	4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4c1adaba30205de927038ba98c8387a1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Users\Admin\AppData\Local\Temp\kvhelper.exe
  C:\Users\Admin\AppData\Local\Temp\kvhelper.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kvhelper.exe

Filesize
172KB

MD5
988f476b428e33dafbe4226fa43847d0

SHA1
d3316d54385ed36f9aa7d5ea87ffd6d9fc515afe

SHA256
0e9d6e46df7d71b550f58b312f51c916225bf09b103f1509bf75496664fbd2ed

SHA512
db5264cd2dd158ff0648091e6b8dd7592af8f200034ec87e91f6f1e4bff75313d191cef7da43bbebc2b557d88ac75a1d9da2d23979c684b4083c9e9841e7fbc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj5D44.tmp\System.dll

Filesize
10KB

MD5
810f3a0aefe36a9f63e29e604bea91a9

SHA1
2559d3d4adf51f8ecbe2d07e669e344eb7d0bd80

SHA256
f160eb7a1b4eb8d2e99e7424ae058acd81ba5019e43cbfa0ce81e3102b356779

SHA512
836b73c38ab60260e1bc81ebf8347e14d02453fc361b7d6f10f137287b8189f8bc43758ce2d9def8fd1c71112aab7ef1930af2d64ae69f6d4e58a6fe17b310bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj5D44.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit