23a964a566c8a4e2cab5da68df811200f936a73347c510aaa71029b4357c46d0

Analysis

max time kernel
91s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec6e4426bb393dee63577fd5028ad00b_JaffaCakes118.exe
Size

697KB
MD5

ec6e4426bb393dee63577fd5028ad00b
SHA1

b9b19943ff008d4b44ffd153636fc5da569b674f
SHA256

23a964a566c8a4e2cab5da68df811200f936a73347c510aaa71029b4357c46d0
SHA512

e265b270f6d1bf1f5e5a5174e7c08b7eb75444fd19ebe12120d5bb9ecab339018bcc6ba3580c5b02e80764efcbbf964c11350d0ae89074b051f49bb4932a5767
SSDEEP

6144:2rcihvKU0a5mcYdoo5Yf6NdEdfy0WEUWwvkL8L3ME4uamALNaACoV9AVYBX+0dyf:2YiAUBx6/EdKWaDajMYuDeK8ci6aWz

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4492	ec6e4426bb393dee63577fd5028ad00b_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\360Install	ec6e4426bb393dee63577fd5028ad00b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4492	ec6e4426bb393dee63577fd5028ad00b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ec6e4426bb393dee63577fd5028ad00b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec6e4426bb393dee63577fd5028ad00b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3603C6D.tmp360net.dll

Filesize
53KB

MD5
400370e02fdcb2baaa9420e4cdc88916

SHA1
2194248a77f3e06558d8576f76078963f29c2c1e

SHA256
093147cacd4ff5b8777dd9802738955a9812add0b7bcfae022aa5ad11f06340d

SHA512
1a45db6da425373097e3df03baf17e29a6135fc92acafca075995abe0586baabad93f61936b7217c9da19fc12d3bf16f934cf0f3c03ed808a3773ae45e192212

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads