f7e16ed08f0ed03e8d5f520216f051a2cd4604defa87b937685a449c449b12b7

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
Size

68KB
MD5

226789f5d6c992debdd10df7756c6cde
SHA1

8e8ad2a5b5dfd8b9907ef5969e87c4496023fa65
SHA256

f7e16ed08f0ed03e8d5f520216f051a2cd4604defa87b937685a449c449b12b7
SHA512

855ef28ffcdc50d994b71ee5cef13cf38be7360b6ef377dbcd2d5a333e36c32e3a08991d51b8fc7b81ef186e5dee0dc735d05aea245075f7486b492d24d34c26
SSDEEP

1536:FNxU+W+73uSpoo3e/8+dcr2yS72WboWWW1/:NU+W+qNo3e9Sy/9sWWW1

Score

8^/10

persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\system32\\\\services.exe"	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fnha30 = "C:\\Windows\\system32\\.exe"	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\J\netdhcp.exe	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\J\servicess.exe	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J\scservice.exe	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\W\fnha30.exe	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\W\fnha30.exe	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J\servicess.exe	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\J\mirror.exe	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J\mirror.exe	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\W	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\J\scservice.exe	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J\netdhcp.exe	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\226789f5d6c992debdd10df7756c6cde_JaffaCakes118.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\W\fnha30.exe

Filesize
69KB

MD5
12d8b561684bd92cf50d4c3e2015ad6f

SHA1
20b549090fad858a49ecc19c089d36c30463a0f1

SHA256
6b1ff35156f44e48cd72ad68c3964d78e25dad9e8548c9cda988fe21efc4b2e4

SHA512
ce5f7aea00d8408fe1175ca79e82d3b3bac0f21a3f677936c55574b54fd8ad8a563ef3f87df64d4f2e4f1a4b54bb021cdf5d9b2549c93efbcedf7288137a9049

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads