16a05d5f7229b1357201fe0058c7c37d2c9dc44d43ed83454ba5f445ca153dec

Analysis

max time kernel
141s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0b03aaee68bcca5a24557329f085635_JaffaCakes118.exe
Size

78KB
MD5

f0b03aaee68bcca5a24557329f085635
SHA1

805a8ef296dd2afb6f6e9ba83fc4be66f8725926
SHA256

16a05d5f7229b1357201fe0058c7c37d2c9dc44d43ed83454ba5f445ca153dec
SHA512

2375f959e7dad386e6a0e63460344cd6debd645c6c9886dde9e8bd534cf59b2a728a517c8fac06ddfb1437231cd0605d69ba0de9787f3c0456595d67e41fa920
SSDEEP

1536:06j+c2C7ZdUeZvziG9/vFD2q5YvCwS0gxtvIo9ZHiv:0637ZdVZ79952qOCwSjBImHiv

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Messenge\Parameters\ServiceDll = "C:\\Windows\\system32\\Messenger.dll"	f0b03aaee68bcca5a24557329f085635_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2312	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Messenger.dll	f0b03aaee68bcca5a24557329f085635_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Messenger.dll	f0b03aaee68bcca5a24557329f085635_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2576	2520	f0b03aaee68bcca5a24557329f085635_JaffaCakes118.exe	87
PID 2520 wrote to memory of 2576	2520	f0b03aaee68bcca5a24557329f085635_JaffaCakes118.exe	87
PID 2520 wrote to memory of 2576	2520	f0b03aaee68bcca5a24557329f085635_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\f0b03aaee68bcca5a24557329f085635_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0b03aaee68bcca5a24557329f085635_JaffaCakes118.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del C:\Users\Admin\AppData\Local\Temp\F0B03A~1.EXE
  2⤵
  PID:2576

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\messenger.dll

Filesize
72KB

MD5
7c5490a19523579a63d7b84dc3ab775b

SHA1
9709beea9d588df0caccd97cfa0c5f82391332e8

SHA256
cbb85dc095f31e63f0fac61e72f47f4e13ac7e04f025bb85a42490fe499e840d

SHA512
51e39f794d7f6351e96ec75fdbc0ab9b2e1211d0b2285493e14a02508c896567d0bb6cfe860081fdeff6fe3094df36369e43e0eca4faff1de31131a4bb661c0c

Download Submit
memory/2312-5-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2312-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2312-12-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2520-4-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads