17fe35d1dcbd4520e9557269bb44481135e6f614750365e4fba789de7eedcb34

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4db5a25286610d5fe027116fffdc1a4e_JaffaCakes118.exe
Size

456KB
MD5

4db5a25286610d5fe027116fffdc1a4e
SHA1

94ca8285a469f22d523f28162b3c3d81b4a1a529
SHA256

17fe35d1dcbd4520e9557269bb44481135e6f614750365e4fba789de7eedcb34
SHA512

06b803afefb968d0217975d5d074515b69257aa678c15820759864c02e2ffbd106f1bfed7d92f317d65b673197b3b9938de4f848ced3bf004679e5c9ca965458
SSDEEP

3072:4tZYmy5Jk7dRz1iASs/rYo752KsCp7a/EliKxfJkxbPL1dypZQaSJVr+1Oj:eYmy5JmRz1iAJByGxw1dy7QaSDrY

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3220	PING.EXE
2292	PING.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4340	4db5a25286610d5fe027116fffdc1a4e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 3408	4340	4db5a25286610d5fe027116fffdc1a4e_JaffaCakes118.exe	83
PID 4340 wrote to memory of 3408	4340	4db5a25286610d5fe027116fffdc1a4e_JaffaCakes118.exe	83
PID 4340 wrote to memory of 3408	4340	4db5a25286610d5fe027116fffdc1a4e_JaffaCakes118.exe	83
PID 3408 wrote to memory of 3220	3408	cmd.exe	86
PID 3408 wrote to memory of 3220	3408	cmd.exe	86
PID 3408 wrote to memory of 3220	3408	cmd.exe	86
PID 3408 wrote to memory of 2292	3408	cmd.exe	90
PID 3408 wrote to memory of 2292	3408	cmd.exe	90
PID 3408 wrote to memory of 2292	3408	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\4db5a25286610d5fe027116fffdc1a4e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4db5a25286610d5fe027116fffdc1a4e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\MoveFile.bat
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\PING.EXE
    ping -a 127.1
    3⤵
    - Runs ping.exe
    PID:3220
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.1
    3⤵
    - Runs ping.exe
    PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MoveFile.bat

Filesize
303B

MD5
049dde06b68aa233397d7f3920d99f87

SHA1
b390ccd3ce21fee479347aafdc2c1f7376c35195

SHA256
3baef4bd14ce9bc9dd1947c17817ae2d1e02820036ef01bd823cd4254afd36ae

SHA512
1d3c1fa4b4ff3f45a9d3771bd74de3710e907bdcb540444e057964b91f3f43dc198188657d17f18cf5842e07fd878eb1be3d9096d1f514c61a374f3bffa198a4

Download Submit
memory/4340-0-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4340-5-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download