b9bdd1211a46e25bdeb9d884e3fd0b652925d2901de072c608d92a2c89f6a179

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe
Size

136KB
MD5

2121fbee78921f58bc1391ab01f650a7
SHA1

3c77d3532f160f537549f238e6b7a0bb8dc09fc2
SHA256

b9bdd1211a46e25bdeb9d884e3fd0b652925d2901de072c608d92a2c89f6a179
SHA512

f39372e4f627cd1de8ec1319b9ead5cae7680981ec7e78ea974024451459c1f05609dffe30d3361026555cd5cf85eb89f6e25e6945b2405575a2f81d1ac9cfa3
SSDEEP

3072:LdVR8ySKMVBHsLyqS257pvDrOhE4rutL11Qh/nv5p3a:LN8brSlpevitJah/nRU

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Loads dropped DLL 1 IoCs

pid	Process
1640	2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Wave Wizard = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe"	2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ratendis.dll	2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ratendis.dll	2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ndisconf.exe	2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ndisconf.exe	2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\diagndis.dll	2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\diagndis.dll	2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1640	2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1640	2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2121fbee78921f58bc1391ab01f650a7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\diagndis.dll

Filesize
56KB

MD5
b9805c9ffb6d7cb94cb39d27a62313b5

SHA1
e0720aa0a35c21a924e0833fa284b626d6694ff6

SHA256
dec81b963c4755153e1d78186cd34fad55611cb1d9f73e0ee6fd0b99ef8daa3b

SHA512
b8d1c3fb1eed77aab5b7cf3fa824b4cd0e7b66e9395af052375bcd8fb51fe61c35263a3a2c4f0ea808ba015d188c70bc1d8b52380f6cdc8fca1dbf9b34091612

Download Submit