698373b437c3a373c5150f70f79bfd57ac7044501ebd7600767616dbb7b2a3d1

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe
Size

29KB
MD5

ecfb1315921bb073a68c6ba62a0a6058
SHA1

292f3644a8cc5a48f6f973cc5e5877e9dfc866fd
SHA256

698373b437c3a373c5150f70f79bfd57ac7044501ebd7600767616dbb7b2a3d1
SHA512

1de326162133ee0e1fb7597fb5033e4f01831fe29125d85f716d05630b1a732a0e544e959b0343a4fed4954ddf258e9f3a0ce588a04a7732fb27348cc3d5425b
SSDEEP

384:DgXz6HmWSMXtWYjfvOqADvaWj90XcQfg/7lY77x8pM+1CL9A1FLuDenlwL98mhWj:MXz6HmoXtxj389M7Sl1CwFLPO95Jnn8

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

msconfig.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	msconfig.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\msconfig.exe"	msconfig.exe

Executes dropped EXE 1 IoCs

Processes:

msconfig.exe

pid process

1732 msconfig.exe
Loads dropped DLL 2 IoCs

Processes:

ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe

pid process

1980 ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe
1980 ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe

pid	process
1732	msconfig.exe

pid	process
1980	ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe
1980	ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msconfig.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\msconfig.exe"	msconfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\msconfig.exe"	msconfig.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exemsconfig.exe

pid process

1980 ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe
1732 msconfig.exe
1732 msconfig.exe
1732 msconfig.exe
1732 msconfig.exe
1732 msconfig.exe

pid	process
1980	ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe
1732	msconfig.exe
1732	msconfig.exe
1732	msconfig.exe
1732	msconfig.exe
1732	msconfig.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe

description	pid	process	target process
PID 1980 wrote to memory of 1732	1980	ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe	msconfig.exe
PID 1980 wrote to memory of 1732	1980	ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe	msconfig.exe
PID 1980 wrote to memory of 1732	1980	ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe	msconfig.exe
PID 1980 wrote to memory of 1732	1980	ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe	msconfig.exe

C:\Users\Admin\AppData\Local\Temp\ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ecfb1315921bb073a68c6ba62a0a6058_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Roaming\msconfig.exe
  "C:\Users\Admin\AppData\Roaming\msconfig.exe"
  2⤵
  - Modifies firewall policy service
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\msconfig.exe

Filesize
29KB

MD5
ecfb1315921bb073a68c6ba62a0a6058

SHA1
292f3644a8cc5a48f6f973cc5e5877e9dfc866fd

SHA256
698373b437c3a373c5150f70f79bfd57ac7044501ebd7600767616dbb7b2a3d1

SHA512
1de326162133ee0e1fb7597fb5033e4f01831fe29125d85f716d05630b1a732a0e544e959b0343a4fed4954ddf258e9f3a0ce588a04a7732fb27348cc3d5425b

Download Submit
memory/1732-9-0x0000000000230000-0x000000000023B000-memory.dmp

Filesize
44KB

Download
memory/1732-11-0x0000000000230000-0x000000000023B000-memory.dmp

Filesize
44KB

Download