f788e3a3ba377d7adcf4696306d4334dbc2ff5368b410bab605fe621f5f14d11

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe
Size

1.1MB
MD5

640ff6bc09df3e70886dc21a59b64c6d
SHA1

82f9afd997cd24bd63a4c708b7ab540b91883f98
SHA256

f788e3a3ba377d7adcf4696306d4334dbc2ff5368b410bab605fe621f5f14d11
SHA512

2fe0ab658223cf1959e923634ecdb813251bc27216e2356d70b939b498c4de49f8214be731deb6daadd45ebd52e0b0f2faec5e742fbb00b1f3cf106a03e72d2b
SSDEEP

24576:JV7l6jVBxpW5MjXgJFbtx1e5Gign0d1JkNLK7HgU1Z+ZaNp5PG7i8F5H6:JV7lcjLW5MjX0tx1ytgn0FILK7Hg63JR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2868	INS6D25.tmp

Loads dropped DLL 3 IoCs

pid	Process
2844	640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe
2868	INS6D25.tmp
2868	INS6D25.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2868	INS6D25.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2868	2844	640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe	30
PID 2844 wrote to memory of 2868	2844	640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe	30
PID 2844 wrote to memory of 2868	2844	640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe	30
PID 2844 wrote to memory of 2868	2844	640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe	30
PID 2844 wrote to memory of 2868	2844	640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe	30
PID 2844 wrote to memory of 2868	2844	640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe	30
PID 2844 wrote to memory of 2868	2844	640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\INS6D25.tmp
  C:\Users\Admin\AppData\Local\Temp\INS6D25.tmp /SL3 $30158 C:\Users\Admin\AppData\Local\Temp\640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe 1194465 1197923 66048
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\INS6D25.tmp

Filesize
522KB

MD5
9893a0d7224fa1fd5f39614c18120265

SHA1
c63eafa4b4155f4ce089e515197bae692ee74dc5

SHA256
5fea72be939af54721857ba760b6a12825da0d8327e41c4ee2faa223f48c6c0e

SHA512
fe63e80f0510036b3ddbdd9cccb8ce387b6371a6e1c3199a05930d95536ee00ec7106a12e2a7ac7aedb704d44e081bf1f190288c8d08a4f990ccf3ec8d20c428

Download Submit
\Users\Admin\AppData\Local\Temp\is-U2TNQ.tmp\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/2844-11-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2868-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download