8aa47e815def1309348179b6a2608ccec58b3ded6e7868ff2673749655f2eea4

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc76088256f94f4130c58028adfdc6fc_JaffaCakes118.exe
Size

24KB
MD5

fc76088256f94f4130c58028adfdc6fc
SHA1

153451f417e32acbc8f99d40a5065ee5babc97ab
SHA256

8aa47e815def1309348179b6a2608ccec58b3ded6e7868ff2673749655f2eea4
SHA512

b13b623c5a104fa6af0364571173ef456c8c63be5308b76c493e597327da7c4057a9f74fadbbfa092294280753bfcfc76db0305e12a49579b32d0b55bced4cee
SSDEEP

384:E3eVES+/xwGkRKJ0llM61qmTTMVF9/q5/0:bGS+ZfbJ0lO8qYoA8

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	fc76088256f94f4130c58028adfdc6fc_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	fc76088256f94f4130c58028adfdc6fc_JaffaCakes118.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2724	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1448	ipconfig.exe
4844	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	tasklist.exe
Token: SeDebugPrivilege	4844	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2224	fc76088256f94f4130c58028adfdc6fc_JaffaCakes118.exe
2224	fc76088256f94f4130c58028adfdc6fc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4840	2224	fc76088256f94f4130c58028adfdc6fc_JaffaCakes118.exe	84
PID 2224 wrote to memory of 4840	2224	fc76088256f94f4130c58028adfdc6fc_JaffaCakes118.exe	84
PID 2224 wrote to memory of 4840	2224	fc76088256f94f4130c58028adfdc6fc_JaffaCakes118.exe	84
PID 4840 wrote to memory of 2268	4840	cmd.exe	86
PID 4840 wrote to memory of 2268	4840	cmd.exe	86
PID 4840 wrote to memory of 2268	4840	cmd.exe	86
PID 4840 wrote to memory of 1448	4840	cmd.exe	87
PID 4840 wrote to memory of 1448	4840	cmd.exe	87
PID 4840 wrote to memory of 1448	4840	cmd.exe	87
PID 4840 wrote to memory of 2724	4840	cmd.exe	88
PID 4840 wrote to memory of 2724	4840	cmd.exe	88
PID 4840 wrote to memory of 2724	4840	cmd.exe	88
PID 4840 wrote to memory of 1892	4840	cmd.exe	92
PID 4840 wrote to memory of 1892	4840	cmd.exe	92
PID 4840 wrote to memory of 1892	4840	cmd.exe	92
PID 1892 wrote to memory of 5108	1892	net.exe	93
PID 1892 wrote to memory of 5108	1892	net.exe	93
PID 1892 wrote to memory of 5108	1892	net.exe	93
PID 4840 wrote to memory of 4844	4840	cmd.exe	94
PID 4840 wrote to memory of 4844	4840	cmd.exe	94
PID 4840 wrote to memory of 4844	4840	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\fc76088256f94f4130c58028adfdc6fc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc76088256f94f4130c58028adfdc6fc_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2268
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1448
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:5108
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
14KB

MD5
f1df102cb7e9eb1f7822fa8579b10552

SHA1
3b4074ef992dd4d751f7a88013e2c927450938e8

SHA256
2d41da39be6bc2772da23b074060884c9b2f077703b06302a4e2f75f8add4fb3

SHA512
385a853e44dcb85a3573d83cddb5762ca75746e49d5bf23ba24cea54ad6101e4c30f8108cf53b8a8e1f84c970ca6f3feca6f418a089e1a49bd879d5ae1fc7115

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads