2e97f2e80f18f8e6f8128a32b941c069388f69845293d15cb9a9c1dff831a93c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe
Size

162KB
MD5

6035f96a05786f8c329da2be71136e3e
SHA1

5697bdec87680903c5b2159c4e956d42ec74da1b
SHA256

2e97f2e80f18f8e6f8128a32b941c069388f69845293d15cb9a9c1dff831a93c
SHA512

4a057192006f75ccd3d7de8ef7ea782166aba13e81d414f87272d1a0342cd123a5cfebcb9c72dea5e776fb9c31407f7b40078dad38d0cd082db733657afe28ff
SSDEEP

3072:wgXdZt9P6D3XJY4511si+JIpNVd/C290bJtY1XG7KYovILxGQ/8DbbGsafbAsX:we34SOSopNVc59yG7HovKrY3GXEsX

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
2836	6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe
2836	6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe
2836	6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe
2836	6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe
2836	6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe
2836	6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe
2836	6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe
2836	6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe
2836	6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\movie_01_2.ico	6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2216	2836	6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe	87
PID 2836 wrote to memory of 2216	2836	6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe	87
PID 2836 wrote to memory of 2216	2836	6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6035f96a05786f8c329da2be71136e3e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c \DelUS.bat
  2⤵
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DelUS.bat

Filesize
228B

MD5
f58a2ec5cc79b05ecfa1b160041da2cb

SHA1
ec7151c0ebaea8d47cffbde7cf1b1abb71c00094

SHA256
107fc326ce68db49443e26ffd15df2ec580eb5c6f82f3a432d7e40df1e123b4a

SHA512
642bf37a60009ba7be2c85ba212387c37fcfa9b71c6bda1e115007cde3aa480597f9cce0d50b068ae56f8edefa8405f13b9cf19089f460300d87b92fdc541bfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseC43B.tmp\Math.dll

Filesize
66KB

MD5
9eb6cecdd0df9fe32027fcdb51c625af

SHA1
52b5b054ff6e7325c3087822901ea2f2c4f9572a

SHA256
54cf1572ed47f614b0ffb886c99fc5725f454ef7ff919fbb2fd13d1cbe270560

SHA512
864742ec6f74f94057b54cd9b09707c0125ac8db4844fa80af201e8b72a811bb68276c993e75bce67e5ece4f83644572edbdee5e963634c5a37839615faea97a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseC43B.tmp\MicroCount.dll

Filesize
52KB

MD5
2b9ccb55357bcdf94cbedbf2d4484853

SHA1
bf7a22e0f54741de3b60e75d08e9f5e37b047c19

SHA256
152d4ee2e8a3522f642ac8b624c7e65c89538da1c1c2300532540274c93089b3

SHA512
168becc845e7c6eaaae24e9267ca6338285b07af1a520e116d275fa2a4f89ecff1c6fa22c3276ebc421be5f0fa957939bc51e70cacd3068d1bdc61cdf2fb217e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseC43B.tmp\SelfDelete.dll

Filesize
24KB

MD5
ddc0d6806073a5b034104c88288ca762

SHA1
9663cc10c496f05d6167e19c3920245040e5e431

SHA256
2f4767da9dc7e720d910d32d451674cd08b7892ca753ec5c10b11fe85e12f06b

SHA512
545ca797a397cfcbd9b5d3bd2da2e3219ba7a294e541831655c5763a7f17480fd0b990d0c2e58ba8c71f81d85472b2da6d079b8211b44c40c8c36d21168ec054

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseC43B.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseC43B.tmp\ZenJang.dll

Filesize
72KB

MD5
d73f39eadabc3288bcb169278b1afd83

SHA1
398a0639ce288820d8f6253eedf337505dc196f2

SHA256
cf61a64d88930ed92360c1edd0daf4e5d7f9690cbe70ba66138992d4316001d7

SHA512
c8332c0b3dbaa4dfc996fa7b05e205b3651632fe43b2f4a4b4d070c563cef84e98de6fbc31d17777df9ce9d31fcf1c8cbf7465938d10e95c7322603a29be24ca

Download Submit
memory/2836-10-0x00000000026C0000-0x00000000026DA000-memory.dmp

Filesize
104KB

Download
memory/2836-18-0x00000000026E0000-0x00000000026EE000-memory.dmp

Filesize
56KB

Download
memory/2836-28-0x0000000002DE0000-0x0000000002DF3000-memory.dmp

Filesize
76KB

Download