09fc3f2b861160efb76043f3e16b09650afded6dbe56bc4dc1cb299284bf2a9f

Analysis

max time kernel
141s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe
Size

28KB
MD5

e7d32dbff7233c5c71748746f3406ba2
SHA1

edaca745b398e8c26237b5627508f114e60dd580
SHA256

09fc3f2b861160efb76043f3e16b09650afded6dbe56bc4dc1cb299284bf2a9f
SHA512

decc24fdc83ca0da35f4991136dd47802229163d4b861308b3ef5d4a5b831a76dc1556696095202a7691b2a2f2ffd40d4be7679b3dbd1e95241be3f994086b7c
SSDEEP

384:SDvs1AxlVnvnm6/6evXRMBZ8q6OQgvrOvYl9XVzBPCLB0rLH4CQxUwfSnKf3X1u8:yXAZ8krnISf1otckIiLW1/PEFGUwxTA

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\52358 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\msaueh.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2388 svchost.exe
Drops file in Program Files directory 1 IoCs

Processes:

svchost.exe

description ioc process

File created C:\PROGRA~3\LOCALS~1\Temp\msaueh.exe svchost.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe

pid process

2368 e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe
2368 e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe

pid	process
2388	svchost.exe

description	ioc	process
File created	C:\PROGRA~3\LOCALS~1\Temp\msaueh.exe	svchost.exe

pid	process
2368	e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe
2368	e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe

description	pid	process	target process
PID 2368 wrote to memory of 2388	2368	e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe	svchost.exe
PID 2368 wrote to memory of 2388	2368	e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe	svchost.exe
PID 2368 wrote to memory of 2388	2368	e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe	svchost.exe
PID 2368 wrote to memory of 2388	2368	e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e7d32dbff7233c5c71748746f3406ba2_JaffaCakes118.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
2⤵
- Adds policy Run key to start application
- Deletes itself
- Drops file in Program Files directory
PID:2388

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-0-0x00000000003A0000-0x00000000003A5000-memory.dmp

Filesize
20KB

Download
memory/2368-1-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2368-2-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2368-13-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2388-3-0x0000000000B10000-0x0000000000B18000-memory.dmp

Filesize
32KB

Download
memory/2388-4-0x0000000000B10000-0x0000000000B18000-memory.dmp

Filesize
32KB

Download
memory/2388-5-0x0000000000080000-0x0000000000087000-memory.dmp

Filesize
28KB

Download
memory/2388-6-0x0000000000030000-0x0000000000035000-memory.dmp

Filesize
20KB

Download
memory/2388-8-0x0000000000030000-0x0000000000035000-memory.dmp

Filesize
20KB

Download