f788e3a3ba377d7adcf4696306d4334dbc2ff5368b410bab605fe621f5f14d11

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe
Size

1.1MB
MD5

640ff6bc09df3e70886dc21a59b64c6d
SHA1

82f9afd997cd24bd63a4c708b7ab540b91883f98
SHA256

f788e3a3ba377d7adcf4696306d4334dbc2ff5368b410bab605fe621f5f14d11
SHA512

2fe0ab658223cf1959e923634ecdb813251bc27216e2356d70b939b498c4de49f8214be731deb6daadd45ebd52e0b0f2faec5e742fbb00b1f3cf106a03e72d2b
SSDEEP

24576:JV7l6jVBxpW5MjXgJFbtx1e5Gign0d1JkNLK7HgU1Z+ZaNp5PG7i8F5H6:JV7lcjLW5MjX0tx1ytgn0FILK7Hg63JR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3540	INS7772.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 3540	520	640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe	84
PID 520 wrote to memory of 3540	520	640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe	84
PID 520 wrote to memory of 3540	520	640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:520
- C:\Users\Admin\AppData\Local\Temp\INS7772.tmp
  C:\Users\Admin\AppData\Local\Temp\INS7772.tmp /SL3 $500D8 C:\Users\Admin\AppData\Local\Temp\640ff6bc09df3e70886dc21a59b64c6d_JaffaCakes118.exe 1194465 1197923 66048
  2⤵
  - Executes dropped EXE
  PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\INS7772.tmp

Filesize
522KB

MD5
9893a0d7224fa1fd5f39614c18120265

SHA1
c63eafa4b4155f4ce089e515197bae692ee74dc5

SHA256
5fea72be939af54721857ba760b6a12825da0d8327e41c4ee2faa223f48c6c0e

SHA512
fe63e80f0510036b3ddbdd9cccb8ce387b6371a6e1c3199a05930d95536ee00ec7106a12e2a7ac7aedb704d44e081bf1f190288c8d08a4f990ccf3ec8d20c428

Download Submit
memory/520-8-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3540-7-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/3540-9-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3540-12-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download