c11116e78cadddaecd08ea228afc2a2e17b0feeeff093a4443f8b914acb9913c

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe
Size

385KB
MD5

ec12f24b941ebac9b1b20fa54316c94c
SHA1

234deb459ee1b11c8ce15f69aeaabe81a69455cd
SHA256

c11116e78cadddaecd08ea228afc2a2e17b0feeeff093a4443f8b914acb9913c
SHA512

817a908738474cff89d1f8f63dbb50097cfb3fa566712cabf80345a429969105dc8aeffd65854aef4e1abac4d3ce57a1a29832d740a2d6736e9b82169182a513
SSDEEP

6144:uByddyG377xS2Vp2CeiorXdwTBgWx4v53CpcCJJvH8ddg:Dr7xS2Vp6RwTyCzbJJvH/

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2812	Exploit Chams.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2812	3064	ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe	30
PID 3064 wrote to memory of 2812	3064	ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe	30
PID 3064 wrote to memory of 2812	3064	ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\Exploit Chams.exe
  "C:\Users\Admin\AppData\Local\Temp\Exploit Chams.exe"
  2⤵
  - Executes dropped EXE
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Exploit Chams.exe

Filesize
40KB

MD5
4905e2edc9b05899ffdde135aa84f223

SHA1
508b7e595c9181b04e3f111ed9fa0128f7951b71

SHA256
dd3cc350a9623069263a64afb3454f4e05d80d909a37ec610bd36111ebf21662

SHA512
d7dac5c35a7b96cff7643ecdfe942a92f1ada9151f3b9e3c4eaf8a7b52c62609bd4eb052428f68096c9ce59db6c61c2372c731044d6c7a3b5b3e70dfe5fa041b

Download Submit
memory/2812-11-0x000007FEF5E00000-0x000007FEF679D000-memory.dmp

Filesize
9.6MB

Download
memory/2812-9-0x000007FEF5E00000-0x000007FEF679D000-memory.dmp

Filesize
9.6MB

Download
memory/2812-12-0x000007FEF5E00000-0x000007FEF679D000-memory.dmp

Filesize
9.6MB

Download
memory/3064-0-0x000007FEF60BE000-0x000007FEF60BF000-memory.dmp

Filesize
4KB

Download
memory/3064-1-0x000007FEF5E00000-0x000007FEF679D000-memory.dmp

Filesize
9.6MB

Download
memory/3064-2-0x000007FEF5E00000-0x000007FEF679D000-memory.dmp

Filesize
9.6MB

Download
memory/3064-4-0x000007FEF5E00000-0x000007FEF679D000-memory.dmp

Filesize
9.6MB

Download
memory/3064-10-0x000007FEF5E00000-0x000007FEF679D000-memory.dmp

Filesize
9.6MB

Download