09242c7a5858656833fd62f34a0045ab48efa0d4bdf2f92676b165c40f7e57b5

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f78439678ad39bda6273f9e14ee48ac4_JaffaCakes118.exe
Size

61KB
MD5

f78439678ad39bda6273f9e14ee48ac4
SHA1

953b93775a01571af4d8b99ead0d4dd66390b62b
SHA256

09242c7a5858656833fd62f34a0045ab48efa0d4bdf2f92676b165c40f7e57b5
SHA512

5422f35333588ccb67fb89c7c2455b19f3e3433e6e6e6bde625bc72ab806a447f3d8564b5a7d3729c2b8b8cd0028e3f5b48ccb93189b64b37f3e497933f955c3
SSDEEP

1536:VsdqzkHnsXbTm3l+SlD009bMdu9/SoED+yhz3lTY/uFnJe:Cd7HnsXbTmcSlD0fuaphzVM44

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hidinsvr\PaRamEterS\ServiceDll = "%SystemRoot%\\System32\\hrqxyz.dll"	f78439678ad39bda6273f9e14ee48ac4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\SerViceS\hidinsvr\PaRamEterS\ServiceDll = "%SystemRoot%\\System32\\hrqxyz.dll"	f78439678ad39bda6273f9e14ee48ac4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\CoNtRolSEt003\SerViceS\hidinsvr\PaRamEterS\ServiceDll = "%SystemRoot%\\System32\\hrqxyz.dll"	f78439678ad39bda6273f9e14ee48ac4_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
1708	svcHost.exe

Loads dropped DLL 2 IoCs

pid	Process
4064	f78439678ad39bda6273f9e14ee48ac4_JaffaCakes118.exe
1708	svcHost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\67f49.ini	f78439678ad39bda6273f9e14ee48ac4_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\hrqxyz.dll	f78439678ad39bda6273f9e14ee48ac4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f78439678ad39bda6273f9e14ee48ac4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f78439678ad39bda6273f9e14ee48ac4_JaffaCakes118.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:4064

C:\Windows\SysWOW64\svcHost.exe
C:\Windows\SysWOW64\svcHost.exe -k hidinsvr
1⤵
- Deletes itself
- Loads dropped DLL
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1428 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hrqxyz.dll

Filesize
90KB

MD5
0522118ec3a863389d47c1efd8529467

SHA1
112d75ce48040ddedd4730740623569345f589a9

SHA256
4210b278101c6c2321a20c17ca7343734606f7abb62e100a14631c82848120e2

SHA512
b4ef6a1d3e91f9e5a7a320472f99a17357a4da5cb1e693fc578041f10860a74c729bbb87e5eb2acb8b6e7c1e7327a18a722457682cdfeae0dde67503e75e30e6

Download Submit
memory/4064-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4064-8-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads