2cb85069f3c031f941e34246d43e64f71f2fb426867eff963590f1efd6207f39

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7a910c5e78d2bec592d36b76e8f0044_JaffaCakes118.exe
Size

58KB
MD5

f7a910c5e78d2bec592d36b76e8f0044
SHA1

80175cf8694af2c229abc180fef8932694f480ac
SHA256

2cb85069f3c031f941e34246d43e64f71f2fb426867eff963590f1efd6207f39
SHA512

f1bb6e28eff0bd808d71247d420a2e815078aa7bb750ca40fdf4fe0b0503149b2169f2c2fce42377c0821a33efaef130cd46327c8743bc991d0aa52b6f730c62
SSDEEP

768:G+cnuAx85xcFsrLebwICfxpb1+GjO95d5g97XT/xWpjvukVWh1S1f8guOqc:wINLgwII3p+Gj45jg5tWs/S1f8gPF

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\gfkqox\pARAMETERS\ServiceDll = "%SystemRoot%\\System32\\xmuluc.dll"	f7a910c5e78d2bec592d36b76e8f0044_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gfkqox\pARAMETERS\ServiceDll = "%SystemRoot%\\System32\\xmuluc.dll"	f7a910c5e78d2bec592d36b76e8f0044_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\gfkqox\pARAMETERS\ServiceDll = "%SystemRoot%\\System32\\xmuluc.dll"	f7a910c5e78d2bec592d36b76e8f0044_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
3828	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
3360	f7a910c5e78d2bec592d36b76e8f0044_JaffaCakes118.exe
3828	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\000038d45.001	f7a910c5e78d2bec592d36b76e8f0044_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xmuluc.dll	f7a910c5e78d2bec592d36b76e8f0044_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3828	svchost.exe
3828	svchost.exe
3828	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f7a910c5e78d2bec592d36b76e8f0044_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7a910c5e78d2bec592d36b76e8f0044_JaffaCakes118.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:3360

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k gfkqox
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xmuluc.dll

Filesize
40KB

MD5
534ef3996c443a29a62dee442eb32d81

SHA1
546f141d1ebcdb97f8c7d4a515324bc760d0587f

SHA256
01477da753bf9a0976fe0df57b93bc17e2b1524c6a179f2fb0fa8f0b117cc086

SHA512
ea3a555e21930156448fc5056e50ded173081acd07ccc930f916ec78c1f84ebb307b533f03b8a0931e303eb3950fbebcf32957048b6994fe8f3a3c33d98150dc

Download Submit
memory/3360-5-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/3828-8-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/3828-9-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads