3b4f9b10cf2e4f4c163825e5043cb23855032518d0f7301df3afdb138b21f3b3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1546b1317cfc98775951f54125998a39_JaffaCakes118.hta
Size

906B
MD5

1546b1317cfc98775951f54125998a39
SHA1

c2d2bcad417bb95fdadf7d05809bd829d1411d4e
SHA256

3b4f9b10cf2e4f4c163825e5043cb23855032518d0f7301df3afdb138b21f3b3
SHA512

ad86892445a70821c24548286ecc70f1b6c8173fdf99dff3dd58d270e7a382b42015c87a0d1f3fca8834af5bb52f8cc132531b861f1dcabbd21d118d3ff13c8b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
3044	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3044	2236	mshta.exe	28
PID 2236 wrote to memory of 3044	2236	mshta.exe	28
PID 2236 wrote to memory of 3044	2236	mshta.exe	28
PID 2236 wrote to memory of 3044	2236	mshta.exe	28
PID 2236 wrote to memory of 2856	2236	mshta.exe	31
PID 2236 wrote to memory of 2856	2236	mshta.exe	31
PID 2236 wrote to memory of 2856	2236	mshta.exe	31
PID 2236 wrote to memory of 2856	2236	mshta.exe	31

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\1546b1317cfc98775951f54125998a39_JaffaCakes118.hta"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /F /IM helpctr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\System32\cscript.exe" "C:\Users\Admin\AppData\Local\Temp\log.vbs"
  2⤵
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\log.vbs

Filesize
422B

MD5
7858945d216740d0648e9f82b019faf7

SHA1
c3b88080216ffd6fc644fe773c2aa15b59375305

SHA256
8c6599566b16f59e9578b3a5e5d2b3d783a848797084df482f41a34334bf8a60

SHA512
8ba8334fb0f0b37842ad8e2055fb31310c5a43b3ad6933f9f96361e2507f597f380b7de9fd9cd5b949157b58ab607f6cce4b7aba92a497c1029f4bb37d8438f3

Download Submit