97c7df1200a9500249534446937aad5ed86746752c7c09bfc165fd4c98d2ad97

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

608ae5d095b576f850d6daa4883911f8_JaffaCakes118.exe
Size

439KB
MD5

608ae5d095b576f850d6daa4883911f8
SHA1

b6d53f176c6c12f09e3d521f65d91615073f92a8
SHA256

97c7df1200a9500249534446937aad5ed86746752c7c09bfc165fd4c98d2ad97
SHA512

96b99347e34032e4ae3497b98fbfd4f3501529ece0008832fd2730c49b45c72470f67a767a9ea2ab579fedd10b0d0eb5406b992409d1219c5b46aeca1aaad76f
SSDEEP

6144:Eq/c/3xwj23j38FkcHdCVGGJrodbkGnRoj1ehYA0XnIch1zvv/o57LjJdAGM:E1/3xWkmMrARHchNvvw5lm

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3032	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3032	irsetup.exe
3032	irsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 3032	232	608ae5d095b576f850d6daa4883911f8_JaffaCakes118.exe	85
PID 232 wrote to memory of 3032	232	608ae5d095b576f850d6daa4883911f8_JaffaCakes118.exe	85
PID 232 wrote to memory of 3032	232	608ae5d095b576f850d6daa4883911f8_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\608ae5d095b576f850d6daa4883911f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\608ae5d095b576f850d6daa4883911f8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Users\Admin\AppData\Local\Temp\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\irsetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\irsetup.dat

Filesize
130KB

MD5
81833519d214ad8f19a2511cbe223528

SHA1
fd19ac5a7617eefc4f06ba5ef1747e0b354cd4fb

SHA256
e69357077f373062bdb7ba4bc3638d6c98a73a5a75e67cb8c4bee10b1af79cc8

SHA512
f2ee5d77716db28fb5f9a87d59c178aa5076c56bbb28e1bb5a32ffb51fa2815cbebc6fe8137b1a21549d28bf4d38b2682a750dcb839a5478d20639277ea1f592

Download Submit
C:\Users\Admin\AppData\Local\Temp\irsetup.exe

Filesize
708KB

MD5
9433d5ac20edcf7d39c454fe2f67b43d

SHA1
b46be8abecd975d942bf28987bbda8686f079838

SHA256
3687a458ea72df00e771a62c3eff33849631c662f62c9bb4fa3c735cc2b51b39

SHA512
50fdfb6d8a5305970b65c772de6b1fe1f4791ea379821853579c99e72dc9c3e36d6e9129451ade3084616996abac84137a4446f9747c195695c5d49fd5073ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\irsetup.ini

Filesize
119B

MD5
4a242c4f4c58afe3abc6a6499f8ea278

SHA1
1bfb767f8c5c34f0f793b0becf3ff9f3d9f98491

SHA256
c85e375d7e9f026340958b830a86c30b427f4cff73f3074631f4d57297d3dfe9

SHA512
cc6e4d710948681915f9ee344d4bc6aed56d3409233b524e14019935ce10370c9db77352172d6000eb24a7854c75d076df3b5f8c05765ee43a3b29d456bd5690

Download Submit
C:\Users\Admin\AppData\Local\Temp\suf6lng.9

Filesize
15KB

MD5
65a07854a4ac46c7fcdfafce978a032d

SHA1
2766e37c4a49c4a2b65593061e59ce8e49363c25

SHA256
de4baa540b128b303c3bd6f33e1f7ee7b840143fbdaa3f931519a36d6e9063bc

SHA512
0e6ce00d1d34042fa4aa3e273b186de0bc600197dce37a9418f8653f8d6bb507d4c78d33804cbf7740e02920d4962de684060a5463df458f3764033a4da045c8

Download Submit