3613b38e69ab65bda04d1c0d37417160215d78365838abe4ac8e788235073950

Analysis

max time kernel
138s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e869e96043aaa756f2557310ec5c6ae_JaffaCakes118.exe
Size

11KB
MD5

0e869e96043aaa756f2557310ec5c6ae
SHA1

f419f71aeb4446df1539f46fc6c6893ef5ac5d3a
SHA256

3613b38e69ab65bda04d1c0d37417160215d78365838abe4ac8e788235073950
SHA512

65872981a2ff42dcb423255fb8647d9dd2969c7fd6b4752fe3b8d0b0cabab9c949c9f579665508b61e6ed128dc890fe94f9d290f05f81f7bce79e22d08147db3
SSDEEP

192:vZH+V+cXezw4jWjBdjPZxA2ZB4lor7Pn91sJyFGI:x+IcXeUsqBTLZB4lS7Pnf8yH

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2672	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2992	svchosts.exe

Loads dropped DLL 2 IoCs

pid	Process
1296	0e869e96043aaa756f2557310ec5c6ae_JaffaCakes118.exe
1296	0e869e96043aaa756f2557310ec5c6ae_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU Key = "C:\\Users\\Admin\\AppData\\Roaming\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM Key = "C:\\Users\\Admin\\AppData\\Roaming\\svchosts.exe"	svchosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2992	1296	0e869e96043aaa756f2557310ec5c6ae_JaffaCakes118.exe	28
PID 1296 wrote to memory of 2992	1296	0e869e96043aaa756f2557310ec5c6ae_JaffaCakes118.exe	28
PID 1296 wrote to memory of 2992	1296	0e869e96043aaa756f2557310ec5c6ae_JaffaCakes118.exe	28
PID 1296 wrote to memory of 2992	1296	0e869e96043aaa756f2557310ec5c6ae_JaffaCakes118.exe	28
PID 1296 wrote to memory of 2672	1296	0e869e96043aaa756f2557310ec5c6ae_JaffaCakes118.exe	29
PID 1296 wrote to memory of 2672	1296	0e869e96043aaa756f2557310ec5c6ae_JaffaCakes118.exe	29
PID 1296 wrote to memory of 2672	1296	0e869e96043aaa756f2557310ec5c6ae_JaffaCakes118.exe	29
PID 1296 wrote to memory of 2672	1296	0e869e96043aaa756f2557310ec5c6ae_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\0e869e96043aaa756f2557310ec5c6ae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e869e96043aaa756f2557310ec5c6ae_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Roaming\svchosts.exe
  "C:\Users\Admin\AppData\Roaming\svchosts.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\MDMEDF.tmp_melt.bat
  2⤵
  - Deletes itself
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MDMEDF.tmp_melt.bat

Filesize
293B

MD5
b3b4e0244be85704cd9f10d3d47609e1

SHA1
71294f16dae03dbc6298d600da8478f2a82cf314

SHA256
7e58138e0ad1c0dcb74f5ffdab35ea779d9497caa22e5404f467e41904240a31

SHA512
4206732009fbb97777566c280c3a0187766c8d4d7439f1e16098b3b82c7d9b1dbefe01c9de8979d1830b694ce0a082a12da247e7f431b06060949db8641c2f05

Download Submit
\Users\Admin\AppData\Roaming\svchosts.exe

Filesize
11KB

MD5
0e869e96043aaa756f2557310ec5c6ae

SHA1
f419f71aeb4446df1539f46fc6c6893ef5ac5d3a

SHA256
3613b38e69ab65bda04d1c0d37417160215d78365838abe4ac8e788235073950

SHA512
65872981a2ff42dcb423255fb8647d9dd2969c7fd6b4752fe3b8d0b0cabab9c949c9f579665508b61e6ed128dc890fe94f9d290f05f81f7bce79e22d08147db3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads