63ba84423a4d3c8728b3fab4588eed5145889b98c3d070a5dbfcbbed0be29e9f

Analysis

max time kernel
52s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a47eff79ada6f8e8e14c9f0ace1e0f69_JaffaCakes118.exe
Size 120KB
Sample240613-jnprkatern
SHA256 63ba84423a4d3c8728b3fab4588eed5145889b98c3d070a5dbfcbbed0be29e9f
MD5 a47eff79ada6f8e8e14c9f0ace1e0f69
SHA1 c52d54245552e6df1572e3b64abcafa8c133df10
SHA512 61df678dcec198f390025a76a2a8c16daf80a855d36b17c6aee7ef9de08eaf852fab2a321877f6597ef2cbfbe02dabb13a8a2cfe529b6b8aee56aaf627d6156b
SSDEEP 3072:hbawgcCY9smNVlfIoTtcDTmmHRRlh649V/19dV:hbawHCOsklGDKmRlh649ldV
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\lowsec\user.ds	a47eff79ada6f8e8e14c9f0ace1e0f69_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
528	4396	WerFault.exe	81

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\software\microsoft\internet explorer\main	a47eff79ada6f8e8e14c9f0ace1e0f69_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	a47eff79ada6f8e8e14c9f0ace1e0f69_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a47eff79ada6f8e8e14c9f0ace1e0f69_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a47eff79ada6f8e8e14c9f0ace1e0f69_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:4396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 956
  2⤵
  - Program crash
  PID:528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4396 -ip 4396
1⤵
PID:564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deprecated.cookie

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\deprecated.cookie
Size 91B
SHA256 d07311acf641866e7e84823d2962f593bb655792301dc61ad6f0c6869d9c5937
MD5 99bde3452748e34d6c50275110a6a8d4
SHA1 e79cb2a8db7d8490523529d3861f95ba73a20c23
SHA512 19fd529c6fe60bbbe3710fed93f14d723a13ad427431f855ed84f5e5e496b9f3eb8a6e8c31d740239eb225753d52a4f464b489fdbdeff4477480026263d0f691
MD5 SHA1 SHA512

Submit Download