6cafe5929e1893e6b535de8ac695949f25a297547ec88849ec96b4c090704ff2

Analysis

max time kernel
6s
max time network
7s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 01:15

Sharing

Reason

Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-21T01:15:48Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win7-20240221-en/instance_9-dirty.qcow2\"}"

Report Analysis Logs

General

Target

fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe
Size

84KB
MD5

fe1694f7ab768a645714fbfe868805c1
SHA1

e849250f100caba4f79ccdcc8286ba3aaf066477
SHA256

6cafe5929e1893e6b535de8ac695949f25a297547ec88849ec96b4c090704ff2
SHA512

d0eddde30f653614488f18576e07048722d5dd82c49f2cc3a58e433f60dfb0077fb230c76019d904fe43df74d87ec8d0c0fb7c5eafaaf460952264b536411a97
SSDEEP

1536:NIoxMhd/fLX2E5Gt3Z2OsD+BULaeee940rqKThL+9NPxHGV17515K7BJF1paNY:NIoGzjX2EstZ2OCuUtn940GUkeV1/U75

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2944	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\832726387 = "C:\\Users\\Admin\\832726387.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1632	fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe
Token: SeShutdownPrivilege	1912	shutdown.exe
Token: SeRemoteShutdownPrivilege	1912	shutdown.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1520	1632	fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe	28
PID 1632 wrote to memory of 1520	1632	fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe	28
PID 1632 wrote to memory of 1520	1632	fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe	28
PID 1632 wrote to memory of 1520	1632	fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe	28
PID 1520 wrote to memory of 1700	1520	cmd.exe	30
PID 1520 wrote to memory of 1700	1520	cmd.exe	30
PID 1520 wrote to memory of 1700	1520	cmd.exe	30
PID 1520 wrote to memory of 1700	1520	cmd.exe	30
PID 1632 wrote to memory of 1912	1632	fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe	31
PID 1632 wrote to memory of 1912	1632	fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe	31
PID 1632 wrote to memory of 1912	1632	fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe	31
PID 1632 wrote to memory of 1912	1632	fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe	31
PID 1632 wrote to memory of 2944	1632	fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe	33
PID 1632 wrote to memory of 2944	1632	fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe	33
PID 1632 wrote to memory of 2944	1632	fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe	33
PID 1632 wrote to memory of 2944	1632	fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe1694f7ab768a645714fbfe868805c1_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 832726387 /t REG_SZ /d "%userprofile%\832726387.exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 832726387 /t REG_SZ /d "C:\Users\Admin\832726387.exe" /f
    3⤵
    - Adds Run key to start application
    PID:1700
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /r /f /t 3
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FE1694~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2944

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2432

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-2-0x0000000000260000-0x0000000000267000-memory.dmp

Filesize
28KB

Download
memory/1632-0-0x0000000000250000-0x000000000025E000-memory.dmp

Filesize
56KB

Download
memory/1632-3-0x0000000000170000-0x0000000000194000-memory.dmp

Filesize
144KB

Download
memory/2428-6-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/2432-5-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads