97b9be5b9476c05327cc0eb5379b35ae9e8975dc9d3222dc562a2e7f47e7cc64

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0140f214df84f3b76a091b6c8a9bf47f_JaffaCakes118.exe
Size

48KB
MD5

0140f214df84f3b76a091b6c8a9bf47f
SHA1

ad85b000e063b1d1960797e07dfd56482d365526
SHA256

97b9be5b9476c05327cc0eb5379b35ae9e8975dc9d3222dc562a2e7f47e7cc64
SHA512

553ec6aa460a9809c371442ec4e8b34c78a8fe50fda676fd13edd3905a711bdc01cc00b7f387a94977948a361f7e6e9e0757551e391f1c3f4d82ffe99339e59f
SSDEEP

768:83Mpzgr3sCrhJQENb/ZIWc4F6p1GdZBXSCPFWd9FNKxM6Csii7qswsKCu5c:4cUrNnNb4SdaCP43Kb2swjCu5

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\braviax = "C:\\Windows\\system32\\braviax.exe"	0140f214df84f3b76a091b6c8a9bf47f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\braviax = "C:\\Windows\\system32\\braviax.exe"	0140f214df84f3b76a091b6c8a9bf47f_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\braviax.exe	0140f214df84f3b76a091b6c8a9bf47f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2872	2392	0140f214df84f3b76a091b6c8a9bf47f_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2872	2392	0140f214df84f3b76a091b6c8a9bf47f_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2872	2392	0140f214df84f3b76a091b6c8a9bf47f_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2872	2392	0140f214df84f3b76a091b6c8a9bf47f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0140f214df84f3b76a091b6c8a9bf47f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0140f214df84f3b76a091b6c8a9bf47f_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat" "
  2⤵
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\delself.bat

Filesize
230B

MD5
8226ed4c83e4043632993121a7c4d8f7

SHA1
f5d2f6027945532cd6203de5ddcd010f2f00cd67

SHA256
71ce234fd79b4d360273a167a92584c87258251306e52d6c5eaf95fa4bf2b7c6

SHA512
6ad90d166001a40a46ea27465fb5ea5596f8a1d8adbf9e88bedf5938f1372a90d033fae6a373d9974c5592b68694303dd9f2931f9287a829443f158d62422229

Download Submit
memory/2392-0-0x0000000000220000-0x000000000022C000-memory.dmp

Filesize
48KB

Download
memory/2392-11-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads