e5b5658e02b1cb3a03e5259d1cc2632a95755ec5da92f696388f9481f1452fe6

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
Size

51KB
MD5

1b78c272c9c173e039fe5496ccb1d5f6
SHA1

1b2c16f90ae43b983d9a8441921dd3f90ccd70b5
SHA256

e5b5658e02b1cb3a03e5259d1cc2632a95755ec5da92f696388f9481f1452fe6
SHA512

0c7e4d3b030c28aafe23a416330ad06b9c1b2a59d6d1fde3cf230aa0222bf89dc41b9fb18373491eabefb9a4c912bed4eacc5d14fda0bf7d129dce0a9eef54de
SSDEEP

768:D1WwJwLDhR0SKIBA8mKuwOC939D1U7QhCKSUqFd/8XztqQ0AiTnc5ui:wwEhxURwnpDU7mNSUqFdW8Q0M5ui

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Loads dropped DLL 2 IoCs

pid	Process
3296	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
3296	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	85.12.43.103

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\buwezobu.dll	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\bonojege.dll	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\butomenu.dll	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sikefilo.dll	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\deyibahu.dll	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\poyerike.dll	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\hujuseke	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\vonazupe.dll	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3296	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
3296	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
3296	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
3296	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3296	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3296	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
3296	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 3424	3296	1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1b78c272c9c173e039fe5496ccb1d5f6_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1300,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
1⤵
PID:944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hujuseke

Filesize
1KB

MD5
b7abf38b1b9dfdf2d47d2ef90ca580e7

SHA1
6166db6f9225fe7afdd2b57cec37ab6a0570fcd7

SHA256
68267f87a6209a304f992bc9fe10074910938c12895bc8870945ad50c84a0efe

SHA512
b4ad5992f3b9a5c2672ee99d1208c226ecbd7cc7d73636e286399204c8fb80d3af47683f295f57f1b027b31cc2d7a28e746f54e91c327236105df7edeafa7873

Download Submit
C:\Windows\SysWOW64\sikefilo.dll

Filesize
51KB

MD5
0c23a9ae675823f3c4f9c0497bfde058

SHA1
c80d31dadff02f808ef6b3085dfb7e687ed279d3

SHA256
31872f793cbdf145213a8cc786d46dd9580c8b42f561ea074d8bd02df6640128

SHA512
70e9c3de6bfcc258e8f3255763127c3e4f58076109cf29cd55d2b39ac7721103eef7986d6065b4c85c891ab32cb92ea39080c024197b3f12282adf3258342656

Download Submit
memory/3296-1-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/3296-0-0x000000001001F000-0x000000001002A000-memory.dmp

Filesize
44KB

Download
memory/3296-22-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/3296-24-0x0000000002320000-0x000000000234E000-memory.dmp

Filesize
184KB

Download
memory/3296-26-0x0000000002320000-0x000000000234E000-memory.dmp

Filesize
184KB

Download