38a8bbe565c498faa53bc4005378cf28120e1b13b8154d91e12650c7f5e41d52

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
Size

366KB
MD5

f052c22a54c49c53abf1936adc05eace
SHA1

d95e7b6243392308d3cd2631636a675731fcf613
SHA256

38a8bbe565c498faa53bc4005378cf28120e1b13b8154d91e12650c7f5e41d52
SHA512

e380442f07eebf9f4c291fff3d4a683c3187cf7a3a478f7dcf8d923c623a3d0b8501b04cc90dc4bf25114f851749037b258fa94259cbf469b398288db9971be0
SSDEEP

6144:IgXJ2G2EAXdHVk/sa51lO7g7UL4mlu1F7AS+cvddUfiHVi:GG2EAXdHVUsaRO7gxmluj/dhHV

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vnet = "C:\\dropped.exe"	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll.exe"	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2688 set thread context of 1600	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	87

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3768	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	86
PID 2688 wrote to memory of 3768	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	86
PID 2688 wrote to memory of 3768	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	86
PID 2688 wrote to memory of 1600	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	87
PID 2688 wrote to memory of 1600	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	87
PID 2688 wrote to memory of 1600	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	87
PID 2688 wrote to memory of 1600	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	87
PID 2688 wrote to memory of 1600	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	87
PID 2688 wrote to memory of 1600	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	87
PID 2688 wrote to memory of 1600	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	87
PID 2688 wrote to memory of 1600	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	87
PID 2688 wrote to memory of 1600	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	87
PID 2688 wrote to memory of 1600	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	87
PID 2688 wrote to memory of 1600	2688	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
  f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
  2⤵
  PID:3768
- C:\Users\Admin\AppData\Local\Temp\f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
  f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
  2⤵
  - Adds Run key to start application
  PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1600-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1600-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2688-0-0x0000000075070000-0x0000000075621000-memory.dmp

Filesize
5.7MB

Download
memory/2688-1-0x0000000075070000-0x0000000075621000-memory.dmp

Filesize
5.7MB

Download
memory/2688-2-0x0000000001820000-0x0000000001830000-memory.dmp

Filesize
64KB

Download
memory/2688-11-0x0000000075070000-0x0000000075621000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads