Overview

overview

5

Static

static

3

e13be6f40b...18.exe

windows7-x64

5

e13be6f40b...18.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 23:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e13be6f40bedf91595e32da9b235a90c_JaffaCakes118.exe

  • Size

    26KB

  • MD5

    e13be6f40bedf91595e32da9b235a90c

  • SHA1

    a9a5389564f5c6be4a871812ad6752ea3d833891

  • SHA256

    00a62b82cbf7e328428064b652b9eb86a25cdf6657fe0ad649180053623683e7

  • SHA512

    19eec72480ac75a3d69dcbd9784913047f63290490f9d0a5cd2b1fcb5b83e663483156fbb39d8e5ff28aa4640b928603d36b8ebd2aaa940fe87e42a94d661ea4

  • SSDEEP

    768:pNw9EM3FW0WQ8YgfbHRcag1fj2jMkHaIw:j7WWbYgjGF1fj2jMkrw

Score
5/10
discovery

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e13be6f40bedf91595e32da9b235a90c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e13be6f40bedf91595e32da9b235a90c_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://voxcards.ig.com.br/secoes/1/cartao/c13_amor_nuncaseesqueca1205.swf
      2⤵
        PID:5056
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4820,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
      1⤵
        PID:4128
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4748,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
        1⤵
          PID:4872
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5372,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
          1⤵
            PID:2196
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5552,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
            1⤵
              PID:3828
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5572,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
              1⤵
                PID:2320
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6132,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
                1⤵
                  PID:1912
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6288,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
                  1⤵
                    PID:2964
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5996,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
                    1⤵
                      PID:3056
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=4656,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
                      1⤵
                        PID:1056
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5732,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
                        1⤵
                          PID:1704

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Windows\SysWOW64\AntiVirus.scr
                          Filesize

                          7KB

                          MD5

                          f32040c3ea2b9a9689efc82d200d938f

                          SHA1

                          c0045d33954e427914df5008483e6055ff359606

                          SHA256

                          31928e35c6d85f22648c3e8e349e2b21570a207a35341003c4ca0c1393ab062a

                          SHA512

                          8c0b50790141cd2d809e3e8233237953291111b3c444e33a95fc7ec80e5b6fc2d9ad14194581a09b4c7c793358aade754c95bb33cecf41ed9c129470e4891811

                          Download Submit

                        • memory/1448-0-0x0000000000400000-0x0000000000413000-memory.dmp

                          Filesize

                          76KB

                          Download

                        • memory/1448-1-0x0000000002160000-0x0000000002161000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1448-8-0x0000000000400000-0x0000000000413000-memory.dmp

                          Filesize

                          76KB

                          Download