097220ee85e37169d54e160276aaad25425636826facccd17ecbd5ab31d4d228

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
Size

69KB
MD5

0ca59122f5d3a3853e67612a48df78ab
SHA1

23d167aa148010956ee0fdb19db0cf730b5608de
SHA256

097220ee85e37169d54e160276aaad25425636826facccd17ecbd5ab31d4d228
SHA512

b0701162232d645779a8672f535ff07e4286f36edf48a336fefb84ddc4437e5bd2b8be5d29f3bb9c2184ad4c4f0605f936b808101ab277ba6365a90aeb5bb12c
SSDEEP

1536:FNxU+W+73uSpoo3e/8+dcr2yS7yt0xzSjo+QQad:NU+W+qNo3e9Sy/K882

Score

8^/10

persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\system32\\\\services.exe"	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tnaa30 = "C:\\Windows\\system32\\.exe"	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\W\tnaa30.exe	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J\servicess.exe	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\J\mirror.exe	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J\mirror.exe	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\J\netdhcp.exe	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J\netdhcp.exe	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\W	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\J\scservice.exe	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J\scservice.exe	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\W\tnaa30.exe	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\J\servicess.exe	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4500,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\W\tnaa30.exe

Filesize
70KB

MD5
850d201583b415916fd82a1c1824dc18

SHA1
cf9dfcb04ca5c14414e8c3196c8a60b2171d637c

SHA256
4e3f8d85557559da455e672ef0953b53938ea604295254d284f9699960af21c9

SHA512
05bad3536b5d09a84f7bb4371b3494d079ce895cb775d31fefb4ef55ea27089bd7678a1a5f154bdc0bc6816f7e79c7f1e2fd4d289bc0ffc284f5c0fbac74ed2d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads