Overview

overview

8

Static

static

3

70789b0e45...18.exe

windows7-x64

8

70789b0e45...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    142s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 01:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe

  • Size

    66KB

  • MD5

    70789b0e45a82b9a0915d1900dc16d66

  • SHA1

    a14fc70b59a35381f1baa32557e92bb67eba8971

  • SHA256

    9e8604e30c32f7975efb0773e8ab04485840685312d0f3623824af0407c539a0

  • SHA512

    8f395d1f6b903847accc6fa8b48b1d46f14a924b92acf880884c287c2145684adeb8468ff567a7751595c79a42605a17ae9e62052503edc26bdc55970fb75aec

  • SSDEEP

    1536:5MPXEmAiRm2VfvmNFnToIf6HTRLar5ZINrWKym:m9Vfv6tTBfoTRLar5ZINrWKym

Score
8/10
persistence

Malware Config

Signatures

  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
    persistence
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\70789B~1.EXE > nul
      2⤵
        PID:3584
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k krnlsrvc
      1⤵
        PID:2892
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\SysWOW64\svchost.exe -k krnlsrvc
        1⤵
        • Loads dropped DLL
        PID:1476

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\RumftqC.dll
        Filesize

        60KB

        MD5

        71d4e061549c64eb4cf18548d1050f96

        SHA1

        0f5244db96cc5f93c2e1ec20b139fae3378721fd

        SHA256

        d7b94347d41bc6898248f9b1b679cb75795e50757fddff09f134bc91c84bdaef

        SHA512

        27f0f44db2c5ad37f629c7c115561286ef40a9838375a0e47da2f953fca782e40b748b136eebbf4211ce4cb0ccfb05b2352e40ff88789137ce24bc50f9f7d431

        Download Submit