201cfa8e6cdc8edc3f8cac47bd4231e4e8c18b1033e839f4e338840b68045d42

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4186b6666739bebf89f51054633fcaec_JaffaCakes118.exe
Size

237KB
MD5

4186b6666739bebf89f51054633fcaec
SHA1

3ce353e25701585f38a95b957534f5122f4f89f1
SHA256

201cfa8e6cdc8edc3f8cac47bd4231e4e8c18b1033e839f4e338840b68045d42
SHA512

f070ca891e8ce8c71521d510fb08b2bc9b319623a21ba4dd6e96d378ad45e7a4953dcf40dc671fe97ce06e7c173bfb24213fad812572a17c4877fe3bc7af38c2
SSDEEP

3072:4bFZBpiJrsZnWSulEobukNhYNcPygJHc0VG25KRiYS2OarUSEJH/86DVJAknokaK:4bF3pSwJPqukpPy6jVGqx+rPE3T1aMp

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2132	racmzae.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\ttbtowf.dll	racmzae.exe
File created	C:\PROGRA~3\Mozilla\racmzae.exe	4186b6666739bebf89f51054633fcaec_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1728	4186b6666739bebf89f51054633fcaec_JaffaCakes118.exe
2132	racmzae.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2132	1632	taskeng.exe	29
PID 1632 wrote to memory of 2132	1632	taskeng.exe	29
PID 1632 wrote to memory of 2132	1632	taskeng.exe	29
PID 1632 wrote to memory of 2132	1632	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\4186b6666739bebf89f51054633fcaec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4186b6666739bebf89f51054633fcaec_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:1728

C:\Windows\system32\taskeng.exe
taskeng.exe {6FC922AA-E98D-40B4-A54E-79FDE2DB1912} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\PROGRA~3\Mozilla\racmzae.exe
  C:\PROGRA~3\Mozilla\racmzae.exe -cddhnyc
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\racmzae.exe

Filesize
237KB

MD5
ba746a1899796a3be30f53daf9c4f406

SHA1
cd24f7303149122f430bf3d7aedec9e96dee05f7

SHA256
afa3c621d04c5cf4b483c388961acfc1e863111780eb04667ce1e3646eb1c685

SHA512
ade7b6f6d1259b2fe85e9241c7fff563e85970193cf09d8c465b7938943ea8ddd49cdda7b84c9552a8fb2b54aa0709322e6b5d96f89f8ea2233b2652fc1988f4

Download Submit
memory/1728-0-0x00000000006C0000-0x000000000071B000-memory.dmp

Filesize
364KB

Download
memory/1728-1-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1728-3-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2132-6-0x00000000002D0000-0x000000000032B000-memory.dmp

Filesize
364KB

Download
memory/2132-7-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2132-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download