Analysis
-
max time kernel
143s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03-07-2024 08:03
General
-
Target
21a2d7f652f0b77d0bfd93de94f7eebc_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
21a2d7f652f0b77d0bfd93de94f7eebc
-
SHA1
4c70ee83a8a40d98389c52ccafe7e38fd48e8928
-
SHA256
6b1193b6ccc722230422035c730490cedb7910b42a034bb5f2578698c4692ff0
-
SHA512
eefadf9b6fb755d650176df166c76ac28bab3a31fcb3fba01deb89c3ccb2a99659b009821f77b6ad5629b8ec878f677c1b535dbe44a06430c8e74beb5fe8c1e4
-
SSDEEP
24576:NjOHprB3g/B74QFwhMZBThQyU1WQWmQ72aDqUHV71D1c:yWN78qD31c
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\21a2d7f652f0b77d0bfd93de94f7eebc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\21a2d7f652f0b77d0bfd93de94f7eebc_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c syscheck.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V tetss.exe /D "\"C:\Users\Admin\AppData\Local\tetss.exe \"" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V tetss.exe /D "\"C:\Users\Admin\AppData\Local\tetss.exe \"" /f4⤵
- Adds policy Run key to start application
- Modifies registry key
-
-
-
-
C:\Users\Admin\AppData\Local\tetss.exeC:\Users\Admin\AppData\Local\tetss.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD53f8aa4f1752d23d44870b331fd2a5b4f
SHA1de799ee8ea491a2032b6aa1775056dbe6d559636
SHA25630012b9eecf7542fcac72861928214cd6748570924630a9963ac40d1182dbbf4
SHA512972090d495b3de5b0fc464b419216b06340a7ebdda76a05cdc503ebe7f8ac45938e08d956130aef7366848747fa8061cf3f7160f006acef86852d0d0d2f90842
-
Filesize
285KB
MD5fe2232f82e4beb5ae483da8e699e1a51
SHA1ed2131d0f70e709f8791bfff64d2b8a4cb658ed5
SHA2560cb462094392aeb31dd7588d95de2577efd0987315be0ce84a531c26bee3b49e
SHA512df9ab5afb94cff850dd5c4b4ba0cfcd77d4a5887ac85a60db223eba8c5d1d64467d77c6133b8e1f5ca795deae3623717ff4cc669919d9f96ef6df193187fcc0b
-
Filesize
237KB
MD56a0abfeea0ca8ba5a20d356613084276
SHA15c1031c0494c8b6d712e4cc17a3feed8df8b589a
SHA25620d4e1635d54a1726769e56e0f93c7ebeb1e1ccc9e7dd1b7d3c54b2a9c689bf7
SHA5123a71dfb18d09274bda72487745a4fdcbe936b8437c873b0209480058e0e7580a63515e4bd236e885ba5144d83848d23179cfacc18e04d44f7f24e815b462facc
-
Filesize
508KB
MD535af8234272b534da59ea1a1c0a0efc2
SHA12d5eac2208826964fb9d2883bc41f86c97d18c8c
SHA25652bc4ec96ac4b55dbc7f22a38f1676ea056b85620be4371c97063cdac51d2b72
SHA512e8d22ca63a5a8dd40c146ebd41c573877d8d6c9fe4d9113c2ab4ad82562b5706cdd1abc8aa117da90c55ae5a7ff5e33a3bfea14170bcfdea5c972ee540fde0c7
-
Filesize
1.2MB
-
Filesize
256KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
548KB
-
Filesize
256KB
-
Filesize
548KB