09ca076680900e3762fe338a9bbb637db54ba8ad95aa13a1d35668e428c3ff4a

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d3d53d1d788bea91a524bc4fddb979e_JaffaCakes118.exe
Size

330KB
MD5

4d3d53d1d788bea91a524bc4fddb979e
SHA1

f566797b93b4c4f790c1e7222c9f6ee584abfc67
SHA256

09ca076680900e3762fe338a9bbb637db54ba8ad95aa13a1d35668e428c3ff4a
SHA512

b4561694ff88bd8da7c534d331738ac7eced118173eaf4c91d23059a6bc0198351fe447d486b097a1198c888eea038fee8fcf9e0b7750eb590f3694cb15b0cc3
SSDEEP

6144:SB8UPybeTtmyPphvAxR/VTBzsu1sQ9XZFMnEKFEKIllp7xWrQb:SKpyPDc1sysQ9XQEKCKIlnxx

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\InetAccelerator.exe	4d3d53d1d788bea91a524bc4fddb979e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\InetAccelerator.exe	4d3d53d1d788bea91a524bc4fddb979e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1648	4d3d53d1d788bea91a524bc4fddb979e_JaffaCakes118.exe
1648	4d3d53d1d788bea91a524bc4fddb979e_JaffaCakes118.exe
1648	4d3d53d1d788bea91a524bc4fddb979e_JaffaCakes118.exe
1648	4d3d53d1d788bea91a524bc4fddb979e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4d3d53d1d788bea91a524bc4fddb979e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d3d53d1d788bea91a524bc4fddb979e_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\InetAccelerator\InetAccelerator.exe

Filesize
330KB

MD5
4d3d53d1d788bea91a524bc4fddb979e

SHA1
f566797b93b4c4f790c1e7222c9f6ee584abfc67

SHA256
09ca076680900e3762fe338a9bbb637db54ba8ad95aa13a1d35668e428c3ff4a

SHA512
b4561694ff88bd8da7c534d331738ac7eced118173eaf4c91d23059a6bc0198351fe447d486b097a1198c888eea038fee8fcf9e0b7750eb590f3694cb15b0cc3

Download Submit