7c599f81153decd38ba8ef288d29bb9868947b15bae7468dae06c90efed3a6a0

Analysis

max time kernel
138s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

035657e51d09471a7ae97c8f1e664fe3_JaffaCakes118.exe
Size

17KB
MD5

035657e51d09471a7ae97c8f1e664fe3
SHA1

693071375de5da743e228550bc5f27a333501f0d
SHA256

7c599f81153decd38ba8ef288d29bb9868947b15bae7468dae06c90efed3a6a0
SHA512

ac8678b328c502c3dcdf226e8326923d217580b07d62116602d5fc360c6718c3cd761cb6470bc26206ccb58d7a4ae34e67a65500a0ba2eefee7c3803c1a7e0d0
SSDEEP

384:mUW/WBlZ5scGOuPlf8AI/EkvXoPNVR3+rmDmEXGq9qV0i+f:pB8lf8AI/EKXoVP+rHEXt20i+f

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\2589B630\ImagePath = "C:\\Windows\\system32\\5B70D3D0.EXE -p"	035657e51d09471a7ae97c8f1e664fe3_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3972	5B70D3D0.EXE

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\5B70D3D0.EXE	035657e51d09471a7ae97c8f1e664fe3_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\5B70D3D0.EXE	5B70D3D0.EXE
File created	C:\Windows\SysWOW64\65E763C8.DLL	5B70D3D0.EXE
File created	C:\Windows\SysWOW64\delme.bat	035657e51d09471a7ae97c8f1e664fe3_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\5B70D3D0.EXE	035657e51d09471a7ae97c8f1e664fe3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4660	035657e51d09471a7ae97c8f1e664fe3_JaffaCakes118.exe
4660	035657e51d09471a7ae97c8f1e664fe3_JaffaCakes118.exe
3972	5B70D3D0.EXE
3972	5B70D3D0.EXE
3972	5B70D3D0.EXE
3972	5B70D3D0.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4788	4660	035657e51d09471a7ae97c8f1e664fe3_JaffaCakes118.exe	85
PID 4660 wrote to memory of 4788	4660	035657e51d09471a7ae97c8f1e664fe3_JaffaCakes118.exe	85
PID 4660 wrote to memory of 4788	4660	035657e51d09471a7ae97c8f1e664fe3_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\035657e51d09471a7ae97c8f1e664fe3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\035657e51d09471a7ae97c8f1e664fe3_JaffaCakes118.exe"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\delme.bat
  2⤵
  PID:4788

C:\Windows\SysWOW64\5B70D3D0.EXE
C:\Windows\SysWOW64\5B70D3D0.EXE -p
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\5B70D3D0.EXE

Filesize
17KB

MD5
035657e51d09471a7ae97c8f1e664fe3

SHA1
693071375de5da743e228550bc5f27a333501f0d

SHA256
7c599f81153decd38ba8ef288d29bb9868947b15bae7468dae06c90efed3a6a0

SHA512
ac8678b328c502c3dcdf226e8326923d217580b07d62116602d5fc360c6718c3cd761cb6470bc26206ccb58d7a4ae34e67a65500a0ba2eefee7c3803c1a7e0d0

Download Submit
C:\Windows\SysWOW64\delme.bat

Filesize
239B

MD5
8be8b032435e702ec8f195660e84fc38

SHA1
d14499bcc75f24148bad0a2647292f767fe409ba

SHA256
19f2814900c5e78fabc684779cfde076246bc335ac578eebcb2f280bc4363d59

SHA512
9f1bb80cf2cd53f2479d61b48702a9599f35e84c1f527b993737e6560c4ac767de9026c11579e8ecfec756bbb64dce0ae998a94e4cf26a54eeb2206912bab56a

Download Submit
memory/3972-5-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/3972-11-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4660-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4660-1-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/4660-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download