c616d32f956484aaf4f2aa093e8ab89d9a17831cb9f0c0c5d4d888573e1599bb

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
Size

18KB
MD5

eac75f730971cc220f109c2bb2119191
SHA1

6f00854b797c390e547a9c0239f185ae2864d46f
SHA256

c616d32f956484aaf4f2aa093e8ab89d9a17831cb9f0c0c5d4d888573e1599bb
SHA512

c0977a583634b74fa03db7aa1b35621eff43d054eaaa38d7d7765d20b6223083229cd6e0ad04f802bd50e42d0af64ae96bfa911d70d317b0a4fb41516702228f
SSDEEP

384:QzhEdV2IcjILrExKc9mpv5LTCl593z0wtyxYxe:lVnckLEvo5Y9DXxe

Score

7^/10

persistence

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1Class1 = "C:\\Users\\Admin\\AppData\\Roaming\\eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe"	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3304 set thread context of 924	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	130

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 1744	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	88
PID 3304 wrote to memory of 1744	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	88
PID 3304 wrote to memory of 1744	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	88
PID 3304 wrote to memory of 4088	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	89
PID 3304 wrote to memory of 4088	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	89
PID 3304 wrote to memory of 4088	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	89
PID 3304 wrote to memory of 4604	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	90
PID 3304 wrote to memory of 4604	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	90
PID 3304 wrote to memory of 4604	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	90
PID 3304 wrote to memory of 1904	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	91
PID 3304 wrote to memory of 1904	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	91
PID 3304 wrote to memory of 1904	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	91
PID 3304 wrote to memory of 1492	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	93
PID 3304 wrote to memory of 1492	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	93
PID 3304 wrote to memory of 1492	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	93
PID 3304 wrote to memory of 1984	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	94
PID 3304 wrote to memory of 1984	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	94
PID 3304 wrote to memory of 1984	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	94
PID 3304 wrote to memory of 5096	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	96
PID 3304 wrote to memory of 5096	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	96
PID 3304 wrote to memory of 5096	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	96
PID 3304 wrote to memory of 1080	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	97
PID 3304 wrote to memory of 1080	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	97
PID 3304 wrote to memory of 1080	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	97
PID 3304 wrote to memory of 816	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	98
PID 3304 wrote to memory of 816	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	98
PID 3304 wrote to memory of 816	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	98
PID 3304 wrote to memory of 2108	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	99
PID 3304 wrote to memory of 2108	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	99
PID 3304 wrote to memory of 2108	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	99
PID 3304 wrote to memory of 4856	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	100
PID 3304 wrote to memory of 4856	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	100
PID 3304 wrote to memory of 4856	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	100
PID 3304 wrote to memory of 920	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	101
PID 3304 wrote to memory of 920	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	101
PID 3304 wrote to memory of 920	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	101
PID 3304 wrote to memory of 4356	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	103
PID 3304 wrote to memory of 4356	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	103
PID 3304 wrote to memory of 4356	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	103
PID 3304 wrote to memory of 2236	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	104
PID 3304 wrote to memory of 2236	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	104
PID 3304 wrote to memory of 2236	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	104
PID 3304 wrote to memory of 3864	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	105
PID 3304 wrote to memory of 3864	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	105
PID 3304 wrote to memory of 3864	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	105
PID 3304 wrote to memory of 2084	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	106
PID 3304 wrote to memory of 2084	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	106
PID 3304 wrote to memory of 2084	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	106
PID 3304 wrote to memory of 4372	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	107
PID 3304 wrote to memory of 4372	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	107
PID 3304 wrote to memory of 4372	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	107
PID 3304 wrote to memory of 3676	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	108
PID 3304 wrote to memory of 3676	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	108
PID 3304 wrote to memory of 3676	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	108
PID 3304 wrote to memory of 4924	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	109
PID 3304 wrote to memory of 4924	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	109
PID 3304 wrote to memory of 4924	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	109
PID 3304 wrote to memory of 4576	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	111
PID 3304 wrote to memory of 4576	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	111
PID 3304 wrote to memory of 4576	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	111
PID 3304 wrote to memory of 924	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	130
PID 3304 wrote to memory of 924	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	130
PID 3304 wrote to memory of 924	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	130
PID 3304 wrote to memory of 924	3304	eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe	130

C:\Users\Admin\AppData\Local\Temp\eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eac75f730971cc220f109c2bb2119191_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:1744
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:4088
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:1904
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:1492
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:1984
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:1080
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:816
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:920
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:4356
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:3864
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:2084
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:4372
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:3676
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:4576
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  PID:924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a.exe

Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
memory/924-5-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/924-9-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/924-23-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/924-24-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/3304-0-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/3304-1-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/3304-2-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

Filesize
64KB

Download
memory/3304-10-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download