51be122929f6ab83b30ce46c54ec0229cb0b693fae825435894ff110486784c6

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0eec9eada66eeca7e239a65f6a107dc9_JaffaCakes118.exe
Size

245KB
MD5

0eec9eada66eeca7e239a65f6a107dc9
SHA1

66c6a41dbe8daa492aab57661447e166657a0110
SHA256

51be122929f6ab83b30ce46c54ec0229cb0b693fae825435894ff110486784c6
SHA512

b97edd1a26f022b3fb2526bc79d216d493af8ccfe4028f7ecda6914b8e17506f89d748abe98cf124efa9f37cfc8e2dd1e693aabd41774a54d6fd04257ca2fbaa
SSDEEP

6144:bOKto0hu+Y1XrHorblsk7BPXS5Es2ATbwiyLp:SD0hmXrHo/lhaEbAAn

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1332	SysHelp.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysHelp.exe	0eec9eada66eeca7e239a65f6a107dc9_JaffaCakes118.exe
File created	C:\Windows\SysHelp.exe	0eec9eada66eeca7e239a65f6a107dc9_JaffaCakes118.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	SysHelp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	SysHelp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	SysHelp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	SysHelp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	SysHelp.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	0eec9eada66eeca7e239a65f6a107dc9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	0eec9eada66eeca7e239a65f6a107dc9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	0eec9eada66eeca7e239a65f6a107dc9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	SysHelp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	SysHelp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	SysHelp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3524	0eec9eada66eeca7e239a65f6a107dc9_JaffaCakes118.exe
3524	0eec9eada66eeca7e239a65f6a107dc9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 3440	3524	0eec9eada66eeca7e239a65f6a107dc9_JaffaCakes118.exe	81
PID 3524 wrote to memory of 3440	3524	0eec9eada66eeca7e239a65f6a107dc9_JaffaCakes118.exe	81
PID 3524 wrote to memory of 3440	3524	0eec9eada66eeca7e239a65f6a107dc9_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\0eec9eada66eeca7e239a65f6a107dc9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0eec9eada66eeca7e239a65f6a107dc9_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17353$$.bat
  2⤵
  PID:3440

C:\Windows\SysHelp.exe
"C:\Windows\SysHelp.exe" /service
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a17353$$.bat

Filesize
152B

MD5
ac23f60219e699d79e890a97e424cef4

SHA1
2eddc70e9fdbb51268067b3c702889d4f66e354e

SHA256
75f503bc1fa62861bf5eeb1172be980c482c7280cd06f43e0ede199ad17d4942

SHA512
9b7bfa5933d49c27c13b72039ebe6ff3731f3c30272051241492fe3636868af2ee6841a0de1c1a3bacad6038ef649fb2a70b94f19a864c09e2f295497b43e1f9

Download Submit
C:\Windows\SysHelp.exe

Filesize
245KB

MD5
0eec9eada66eeca7e239a65f6a107dc9

SHA1
66c6a41dbe8daa492aab57661447e166657a0110

SHA256
51be122929f6ab83b30ce46c54ec0229cb0b693fae825435894ff110486784c6

SHA512
b97edd1a26f022b3fb2526bc79d216d493af8ccfe4028f7ecda6914b8e17506f89d748abe98cf124efa9f37cfc8e2dd1e693aabd41774a54d6fd04257ca2fbaa

Download Submit
memory/1332-79-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1332-83-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/1332-81-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1332-80-0x00000000005E0000-0x0000000000610000-memory.dmp

Filesize
192KB

Download
memory/1332-92-0x00000000005E0000-0x0000000000610000-memory.dmp

Filesize
192KB

Download
memory/1332-90-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3524-13-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/3524-19-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/3524-2-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/3524-40-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/3524-39-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/3524-38-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/3524-37-0x0000000002780000-0x0000000002781000-memory.dmp

Filesize
4KB

Download
memory/3524-36-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/3524-35-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/3524-34-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/3524-33-0x0000000002740000-0x0000000002741000-memory.dmp

Filesize
4KB

Download
memory/3524-32-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/3524-31-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/3524-30-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/3524-29-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/3524-28-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/3524-27-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/3524-26-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/3524-25-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/3524-24-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/3524-44-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/3524-43-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/3524-42-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/3524-41-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/3524-23-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/3524-22-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/3524-21-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/3524-20-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/3524-8-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3524-18-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/3524-17-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/3524-16-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/3524-15-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/3524-14-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/3524-4-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/3524-12-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/3524-11-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/3524-10-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/3524-3-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/3524-9-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/3524-74-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3524-6-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/3524-54-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3524-53-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/3524-52-0x0000000002B90000-0x0000000002B91000-memory.dmp

Filesize
4KB

Download
memory/3524-51-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3524-50-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/3524-49-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/3524-48-0x0000000002B50000-0x0000000002B51000-memory.dmp

Filesize
4KB

Download
memory/3524-47-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/3524-46-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/3524-45-0x0000000002B40000-0x0000000002B41000-memory.dmp

Filesize
4KB

Download
memory/3524-55-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

Filesize
4KB

Download
memory/3524-64-0x0000000002D50000-0x0000000002D51000-memory.dmp

Filesize
4KB

Download
memory/3524-70-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Filesize
4KB

Download
memory/3524-69-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Filesize
4KB

Download
memory/3524-68-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/3524-67-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Filesize
4KB

Download
memory/3524-66-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download
memory/3524-65-0x0000000002D80000-0x0000000002D81000-memory.dmp

Filesize
4KB

Download
memory/3524-63-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/3524-62-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/3524-72-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Filesize
4KB

Download
memory/3524-7-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/3524-76-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/3524-75-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/3524-61-0x0000000002D40000-0x0000000002D41000-memory.dmp

Filesize
4KB

Download
memory/3524-73-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/3524-60-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/3524-59-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/3524-58-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/3524-57-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3524-56-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Filesize
4KB

Download
memory/3524-82-0x0000000002250000-0x0000000002280000-memory.dmp

Filesize
192KB

Download
memory/3524-5-0x0000000002420000-0x0000000002423000-memory.dmp

Filesize
12KB

Download
memory/3524-1-0x0000000002250000-0x0000000002280000-memory.dmp

Filesize
192KB

Download
memory/3524-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3524-88-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3524-87-0x0000000002250000-0x0000000002280000-memory.dmp

Filesize
192KB

Download