350d32527f9981f33a1f080b9eb2984df7f05eba4e0275f26d00ae69baaad551

Analysis

max time kernel
150s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe
Size

13KB
MD5

f90d1b841509a511a80cb3df2901c817
SHA1

50717943cf910d1252b6cd75327219a1274bc5ec
SHA256

350d32527f9981f33a1f080b9eb2984df7f05eba4e0275f26d00ae69baaad551
SHA512

233714f2aeaf848e61125a025bb19c9e3ba80fe2953dcadf085b2d7485a9ca33089a0484d3177f9c4fe82f48efd2e072a8832f130bbabef61f439747d8cb4dd5
SSDEEP

384:nLVguK8/7bpobm6hxlFJBH/umdWxfyZeL6o:pguK8HpobmgxPzvdWVyZe

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2788	cenvtak.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1456-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/files/0x0008000000023401-4.dat	upx
behavioral2/memory/1456-6-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2788-7-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cenvta.dll	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cenvtak.exe	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cenvtak.exe	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2788	1456	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	84
PID 1456 wrote to memory of 2788	1456	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	84
PID 1456 wrote to memory of 2788	1456	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	84
PID 1456 wrote to memory of 4472	1456	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	92
PID 1456 wrote to memory of 4472	1456	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	92
PID 1456 wrote to memory of 4472	1456	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\cenvtak.exe
  C:\Windows\system32\cenvtak.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe.bat
  2⤵
  PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe.bat

Filesize
210B

MD5
9272802650e157dacef7e71d4429f9b6

SHA1
2c724bdddd5ca07c26a595822d232055ab38763a

SHA256
d3ce7d50594b71cde2cac3e9b54437aea625ceeff0fd7c2097f368c9e6e0ef9a

SHA512
926d7334650c6e29a0456b6f4516ec15dc30ba01ed54d6699c99a53106c783faee7f09c0fa0c4488cfadcdb639c60ee2666687017296ceb76e70ad01294bbe97

Download Submit
C:\Windows\SysWOW64\cenvtak.exe

Filesize
13KB

MD5
f90d1b841509a511a80cb3df2901c817

SHA1
50717943cf910d1252b6cd75327219a1274bc5ec

SHA256
350d32527f9981f33a1f080b9eb2984df7f05eba4e0275f26d00ae69baaad551

SHA512
233714f2aeaf848e61125a025bb19c9e3ba80fe2953dcadf085b2d7485a9ca33089a0484d3177f9c4fe82f48efd2e072a8832f130bbabef61f439747d8cb4dd5

Download Submit
memory/1456-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1456-6-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2788-7-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download