6e98c053f9a5fc14c88e63f138faa3296e6ef9b6e9f3b70d16b01d76116d4331

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe
Size

354KB
MD5

14c01629125fa37d04a0e0e86b76a7c8
SHA1

e0a8d814eb5788ed0d0eaa915f186eb7bbca2dbb
SHA256

6e98c053f9a5fc14c88e63f138faa3296e6ef9b6e9f3b70d16b01d76116d4331
SHA512

08b917ce9eaacfed43147dd8063cabdbd2e78cba2d82cea22943035b30c73da7497cb2509e0952facc87bf78b8b7bc4a5f61ce2a3a52443043323f2abb9756e8
SSDEEP

6144:Qe5ItnLFrlB/S7KehAshNwRNWJ6pGA0Wk0ZBjeDj9vwE2IkOI3nd:Q3tLFL4GshNaskpd0WNBSDj9vt2r3d

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysguard = "C:\\Windows\\sysguard.exe"	14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sysguard.exe	14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe
File created	C:\Windows\sysguard.exe	14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5080-4-0x0000000000400000-0x000000000046F7FC-memory.dmp

Filesize
445KB

Download
memory/5080-5-0x00000000004B0000-0x00000000004E5000-memory.dmp

Filesize
212KB

Download
memory/5080-3-0x0000000000400000-0x000000000046F7FC-memory.dmp

Filesize
445KB

Download
memory/5080-2-0x0000000000400000-0x000000000046F7FC-memory.dmp

Filesize
445KB

Download
memory/5080-1-0x0000000000400000-0x000000000046F7FC-memory.dmp

Filesize
445KB

Download
memory/5080-0-0x0000000000400000-0x000000000046F7FC-memory.dmp

Filesize
445KB

Download
memory/5080-8-0x0000000000401000-0x000000000041D000-memory.dmp

Filesize
112KB

Download
memory/5080-9-0x0000000000400000-0x000000000046F7FC-memory.dmp

Filesize
445KB

Download
memory/5080-11-0x00000000004B0000-0x00000000004E5000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads