048621ecf8f25133b2b09d512bb0fe15fc274ec7cb2ccc966aeb44d7a88beb5b

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07e99b2f572b84af5c4504c23f1653bb_JaffaCakes118.exe
Size

139KB
MD5

07e99b2f572b84af5c4504c23f1653bb
SHA1

0ae4e6e6fa1b1f8161a74525d4cb5a1808abfaf4
SHA256

048621ecf8f25133b2b09d512bb0fe15fc274ec7cb2ccc966aeb44d7a88beb5b
SHA512

db5332ec426845b5ac38050b2789cc9cb988b27b81832de53a654e354130a2840b9e25c7486c2b9b75958f1e9a8d8d65fcfc3a6929cf56792acacb78cbcc1014
SSDEEP

3072:dxObYFYLjikGSZ6yYD5WNwgaV5KbwmfAYCQ4ETp:6EFdkFYtW2ganowiAM4Ed

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2436	07e99b2f572b84af5c4504c23f1653bb_JaffaCakes118.exe
2912	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\16443 = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\16443.dll\",_6443"	explorer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2912	explorer.exe
2912	explorer.exe
2912	explorer.exe
2912	explorer.exe
2912	explorer.exe
2912	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	07e99b2f572b84af5c4504c23f1653bb_JaffaCakes118.exe
Token: SeDebugPrivilege	2912	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2912	2436	07e99b2f572b84af5c4504c23f1653bb_JaffaCakes118.exe	28
PID 2436 wrote to memory of 2912	2436	07e99b2f572b84af5c4504c23f1653bb_JaffaCakes118.exe	28
PID 2436 wrote to memory of 2912	2436	07e99b2f572b84af5c4504c23f1653bb_JaffaCakes118.exe	28
PID 2436 wrote to memory of 2912	2436	07e99b2f572b84af5c4504c23f1653bb_JaffaCakes118.exe	28
PID 2436 wrote to memory of 2912	2436	07e99b2f572b84af5c4504c23f1653bb_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\07e99b2f572b84af5c4504c23f1653bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07e99b2f572b84af5c4504c23f1653bb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\16443.dll

Filesize
104KB

MD5
7939da76333bf3b3df743e3bd04467b6

SHA1
297a575e79ad082fdb98f300b0dc66460781b225

SHA256
274cbce935a07007688b2883a0ae4cb74bbc681e5d7e7033ca093ad3383c74de

SHA512
b10c9da8b7ea64bb7c13dd1cf56c3efce917b5977e17e1014b3b949206d5a63780ecbe1225b607a60539e30649a449d2cf0f4832d780091a143051b94c782ec1

Download Submit
memory/2912-4-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download