5f5da3e9e91a65d600124024fc08295d4cb34c8ca4b0a30f050eaae2a734f66f

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Size

17KB
MD5

0519e7a80f28840240e36f5ec89db5c1
SHA1

a6fe7c042238358253bd093664ee822839a65b1b
SHA256

5f5da3e9e91a65d600124024fc08295d4cb34c8ca4b0a30f050eaae2a734f66f
SHA512

2176d23041cbfc66f5aff6f40413677fdad07034b3f168cf12021a8e1337c0e048cd38e3dd52340508e3824836d5b75673ad31db7cd5d22c5e5bcc187bdb2e5f
SSDEEP

384:EJXyUVeTbSh5pnYUsEPRcWuuJuqGEIpGvLtQHlBt0Mx8bnogYLbDdxLO+N9:EJheTehtz5zuuJuqRIpGvmDt0Mx8bIDd

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\zjydcx.dll.LoG	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\zjydcx.dll	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\tf0	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45AADFAA-DD36-42AB-83AD-0521BBF58C24}	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45AADFAA-DD36-42AB-83AD-0521BBF58C24}\ = "Microsoft"	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45AADFAA-DD36-42AB-83AD-0521BBF58C24}\InProcServer32	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45AADFAA-DD36-42AB-83AD-0521BBF58C24}\InProcServer32\ = "C:\\Windows\\SysWow64\\zjydcx.dll"	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45AADFAA-DD36-42AB-83AD-0521BBF58C24}\InProcServer32\ThreadingModel = "Apartment"	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\microsoft	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1052	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	1052	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Token: SeRestorePrivilege	1052	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Token: SeBackupPrivilege	1052	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
Token: SeRestorePrivilege	1052	0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0519e7a80f28840240e36f5ec89db5c1_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads