8883cc13e0f391979e828931e59168cd8bdb1814598323622a51f85ab302f3f8

max time kernel
1762s
max time network
1783s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08456d53df6abf9812cf4549b3b582ea_JaffaCakes118.exe
Size

131KB
MD5

08456d53df6abf9812cf4549b3b582ea
SHA1

500c86eb1e89469dd226f3d664e860f7676a9225
SHA256

8883cc13e0f391979e828931e59168cd8bdb1814598323622a51f85ab302f3f8
SHA512

40125b077f5485be87e6cfb1339651baae342046dc34ed9a5b97541486006511c959ebe89651a0264dd761167886843c6cc597b359cb8384675696999ff3c52b
SSDEEP

1536:BL+O/U7OBmKGS6CBK0t/ZCXPGuxgDM5YKBGNc/xf6KWcs8+SUkIcekqY1o/uImzk:BLxUyjp3xCTyDMsUWyw+Ubx7NR

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mhgutypzru = "C:\\Users\\Admin\\AppData\\Local\\Temp\\08456d53df6abf9812cf4549b3b582ea_JaffaCakes118.exe"	08456d53df6abf9812cf4549b3b582ea_JaffaCakes118.exe

Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2520	svchost.exe

C:\Users\Admin\AppData\Local\Temp\08456d53df6abf9812cf4549b3b582ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08456d53df6abf9812cf4549b3b582ea_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
PID:4124

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Proxy

T1090

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cached-consensus

Filesize
3.1MB

MD5
bb91d0bfe6d262901beb6ded30a52310

SHA1
1f2cae19529fdbbda924802190f17d43b92d8799

SHA256
27ea6c6fb871b3751d814ca3b140feda45c6138792621a04cfba3a69f8bbc77b

SHA512
ca2d4aa400ec7de3661f1d6c01586c3937cfdb89b29230bcd5ccd688330cb375a310e9f19bd55018f84df29f6ed4de2888ba190064a617a4d27d4e3a47e7f359

Download Submit
memory/2520-6-0x0000026B95540000-0x0000026B95550000-memory.dmp

Filesize
64KB

Download
memory/2520-22-0x0000026B95640000-0x0000026B95650000-memory.dmp

Filesize
64KB

Download
memory/2520-38-0x0000026B9D950000-0x0000026B9D951000-memory.dmp

Filesize
4KB

Download
memory/2520-40-0x0000026B9D980000-0x0000026B9D981000-memory.dmp

Filesize
4KB

Download
memory/2520-41-0x0000026B9D980000-0x0000026B9D981000-memory.dmp

Filesize
4KB

Download
memory/2520-42-0x0000026B9DA90000-0x0000026B9DA91000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads