d5c8fcfef1df24038a6446878e358e4423ea28c12d847c3a5546ae58eac165d3

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
Size

2.7MB
MD5

c09c85a32b58764de8c2c2d268296c26
SHA1

de6ee731ec816d8a6423bade5478f280bb51397d
SHA256

d5c8fcfef1df24038a6446878e358e4423ea28c12d847c3a5546ae58eac165d3
SHA512

100903458d3ead59fa38ef1169f314b2a62ef2fb5289ab49d97bd81785980255fdbff20d5789bc031816ea817710fae07f338404e10cf343dcb5fc36440ae787
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBR9w4Sx:+R0pI/IQlUoMPdmpSp94

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3600	devbodec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocWN\\devbodec.exe"	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintP8\\dobasys.exe"	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
3600	devbodec.exe
3600	devbodec.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 3600	5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe	87
PID 5084 wrote to memory of 3600	5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe	87
PID 5084 wrote to memory of 3600	5084	c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c09c85a32b58764de8c2c2d268296c26_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5084
- C:\IntelprocWN\devbodec.exe
  C:\IntelprocWN\devbodec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\IntelprocWN\devbodec.exe

Filesize
2.7MB

MD5
35d0aa1e03d45d808909c14526d44766

SHA1
da884868e38692d7f82559cec7ca9f9576f3c713

SHA256
52494d2cf376417fc6a07b67675e84eddef712701100b302f515a3952cbbf472

SHA512
e64756c00b8ab142ac177eafebd44cffbfaec356bad6d6340fb5bbaa79bbb92e94b660ea80be58e4e168e4ca8fdb5e8c3c9176023aff7fa0ce9a487600a0dec1

Download Submit
C:\MintP8\dobasys.exe

Filesize
19KB

MD5
13b7be4099f3920c0a076cbbf5b83643

SHA1
a81de9811a57ec2cdbfe1e3a6cbedfbf2fbcfd4e

SHA256
7897ecdf3ddcd3490c17f2cc193f10a2e0b047eddef77884b9b5f187f0d09004

SHA512
fca7da7ace3651a9ca715a8593ce988a8b4f41cdc02d53bb79b7379add25e21edc3c75d7da18fcd92f433fd130cb2c29ea8d686055b1dbef197d00c85fdde05c

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
206B

MD5
ad073e991e5216f2078b86de2928a738

SHA1
d65b7ea1b30941853583c9a7238882ff493aba57

SHA256
764f54ddb2c9dab886da2b9987c171b768c79665cfc151c7c592f10f48c67a1c

SHA512
c2bfb9f512d7b8ee6cfd4d971f405e94a800e1facef9cc192eb1ec6e9ee564c6239fbd34d23f3da2bdc23e43763688bedf6b578625648326a5781aaa16176a76

Download Submit