580e6dc86cdead3e2c638a1d16474c0c4ccbb04fbbdad6fdb8e9dfbe838ed4e2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a485d639ede266a07552304669164d2_JaffaCakes118.exe
Size

172KB
MD5

0a485d639ede266a07552304669164d2
SHA1

fdb893ce06a34568d42ed275f95d31f4c1e53aa5
SHA256

580e6dc86cdead3e2c638a1d16474c0c4ccbb04fbbdad6fdb8e9dfbe838ed4e2
SHA512

71be7597bc5ad912b93740491bb93c901cbb0549999d5fcd0a358c1a30c258108131f0cb48ac185808e8db78537c6dcb801f129b89d0cd89e3af9f17c269aebf
SSDEEP

3072:gcBycVFJkupI+RbgNdA0D90D7fUkUIbNCYsrrlknZGfM4I4s7akKk:gzcVFJkYFedBDiXfBUB7/IaM2

Score

7^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Print Processors 1 TTPs 2 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
File created	C:\Windows\system32\spool\PRTPROCS\x64\qG31a93.dll	0a485d639ede266a07552304669164d2_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\spool\PRTPROCS\x64\qG31a93.dll	0a485d639ede266a07552304669164d2_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRTPROCS\x64\qG31a93.dll	0a485d639ede266a07552304669164d2_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\spool\PRTPROCS\x64\qG31a93.dll	0a485d639ede266a07552304669164d2_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1044	0a485d639ede266a07552304669164d2_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1044	0a485d639ede266a07552304669164d2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0a485d639ede266a07552304669164d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a485d639ede266a07552304669164d2_JaffaCakes118.exe"
1⤵
- Boot or Logon Autostart Execution: Print Processors
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-0-0x00000000001B0000-0x00000000001BD000-memory.dmp

Filesize
52KB

Download
memory/1044-1-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1044-3-0x00000000770C0000-0x00000000770C1000-memory.dmp

Filesize
4KB

Download
memory/1044-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads