bc2459ec4364fedb52c2b04a478779139168a83bd61e4be360f12717d238809c

Analysis

max time kernel
141s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 09:18

Target

1abdd32e819abad33a0a77fe9e1e0eea_JaffaCakes118.exe
Size

51KB
MD5

1abdd32e819abad33a0a77fe9e1e0eea
SHA1

0c552dea88035bde97372d191d34a750b27f19a7
SHA256

bc2459ec4364fedb52c2b04a478779139168a83bd61e4be360f12717d238809c
SHA512

949611e4e21866ca958b6c2ee24ae3f52f4f94b2a93dd04401c44f80f6502cb0b8e4f73325ae7b92e6b2aef3910d19c4773adab4f88ff5de1828d9e5ff6bb626
SSDEEP

1536:QCqVQRyD9qys10FrNYQexFmHc1EJ38fpiswrQS:QCyJ5ri3fE9Ui

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4556	ctfmon.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\notepad.cfg	ctfmon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	ctfmon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "2"	ctfmon.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4556	ctfmon.exe
4556	ctfmon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\1abdd32e819abad33a0a77fe9e1e0eea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1abdd32e819abad33a0a77fe9e1e0eea_JaffaCakes118.exe"
1⤵
PID:116

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\ctfmon.exe

Filesize
51KB

MD5
1abdd32e819abad33a0a77fe9e1e0eea

SHA1
0c552dea88035bde97372d191d34a750b27f19a7

SHA256
bc2459ec4364fedb52c2b04a478779139168a83bd61e4be360f12717d238809c

SHA512
949611e4e21866ca958b6c2ee24ae3f52f4f94b2a93dd04401c44f80f6502cb0b8e4f73325ae7b92e6b2aef3910d19c4773adab4f88ff5de1828d9e5ff6bb626

Download Submit
memory/116-7-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4556-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download