9d733d72f801f6c32c32b491ee99915f579b72467e019ccfc06c8da2ceb29a22

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07b149d5379d8dfa408e0211b0d4cb3d_JaffaCakes118.exe
Size

19KB
MD5

07b149d5379d8dfa408e0211b0d4cb3d
SHA1

f8743b6358e1b3fd10d15a3c7fa19ef97b61b69f
SHA256

9d733d72f801f6c32c32b491ee99915f579b72467e019ccfc06c8da2ceb29a22
SHA512

b8bc2504d03bb43fd2001b0793145c0b05947191e83d1453ab72c67921da8e80567538d0367ed8db65d419fdd69d9f0ab71eab5ba03f48ac520dc3dbf656b032
SSDEEP

192:q6RS/X82zJx4NI1xN8ewjUNHyzL6gQB3fca7N5L2SM4mDWdFRv:zmXdqI1xN4HkJLmS/n

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
956	07b149d5379d8dfa408e0211b0d4cb3d_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\fiosectc = "C:\\Windows\\fiosectc.exe"	07b149d5379d8dfa408e0211b0d4cb3d_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fiosectc.dll	07b149d5379d8dfa408e0211b0d4cb3d_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\fiosectc.exe	07b149d5379d8dfa408e0211b0d4cb3d_JaffaCakes118.exe
File opened for modification	C:\Windows\fiosectc.exe	07b149d5379d8dfa408e0211b0d4cb3d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
956	07b149d5379d8dfa408e0211b0d4cb3d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1188	956	07b149d5379d8dfa408e0211b0d4cb3d_JaffaCakes118.exe	21
PID 956 wrote to memory of 1188	956	07b149d5379d8dfa408e0211b0d4cb3d_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\07b149d5379d8dfa408e0211b0d4cb3d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\07b149d5379d8dfa408e0211b0d4cb3d_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\fiosectc.dll

Filesize
30KB

MD5
fcb4665a9369094991409d1f32cce4c8

SHA1
f2beb859cb920bc68e5a306cfc4bac2830f9c901

SHA256
74e9e8fea26958f09b52de864704da0a835ac73bd0ba71f0ca5cc3d929e5382f

SHA512
f5610d47b9f99741643db3a31be40285b5c3df4957360b44415b2418cb9b0cde9203a366529dd02d1227820afb6009067db1294fe7e27b743056f06faabb8403

Download Submit
memory/956-15-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/956-11-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/956-20-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/956-21-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1188-2-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download