c1e11a48542203f8bf4d4d8ae76c7e99699da9671c449db8be71b53f547477e9

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2327569f0f2f8083a202481348dd386e_JaffaCakes118.exe
Size

31KB
MD5

2327569f0f2f8083a202481348dd386e
SHA1

91336479a23bbbc71e87771297d20d87d5751415
SHA256

c1e11a48542203f8bf4d4d8ae76c7e99699da9671c449db8be71b53f547477e9
SHA512

9c6dd89e46887c6fa557458f3abecca8fc06ff6869ab88f85bc9baffd58f432f755b2763144198d31f78ba9a699ba80ee5ffc58b5b715867a7d102211961c7a0
SSDEEP

768:2PYRPy2urgqE8QmP5pd87SfHJRbkYWhE9w:2PqOBr27eES

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Deletes itself 1 IoCs

pid	Process
1632	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GameMon.des	2327569f0f2f8083a202481348dd386e_JaffaCakes118.exe

Runs regedit.exe 1 IoCs

pid	Process
3060	Regedit.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3060	3008	2327569f0f2f8083a202481348dd386e_JaffaCakes118.exe	28
PID 3008 wrote to memory of 3060	3008	2327569f0f2f8083a202481348dd386e_JaffaCakes118.exe	28
PID 3008 wrote to memory of 3060	3008	2327569f0f2f8083a202481348dd386e_JaffaCakes118.exe	28
PID 3008 wrote to memory of 3060	3008	2327569f0f2f8083a202481348dd386e_JaffaCakes118.exe	28
PID 3008 wrote to memory of 1632	3008	2327569f0f2f8083a202481348dd386e_JaffaCakes118.exe	29
PID 3008 wrote to memory of 1632	3008	2327569f0f2f8083a202481348dd386e_JaffaCakes118.exe	29
PID 3008 wrote to memory of 1632	3008	2327569f0f2f8083a202481348dd386e_JaffaCakes118.exe	29
PID 3008 wrote to memory of 1632	3008	2327569f0f2f8083a202481348dd386e_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\2327569f0f2f8083a202481348dd386e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2327569f0f2f8083a202481348dd386e_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\Regedit.exe
  Regedit.exe /s C:\1^.txt
  2⤵
  - Runs regedit.exe
  PID:3060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\2327569f0f2f8083a202481348dd386e_JaffaCakes118.exe
  2⤵
  - Deletes itself
  PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1^.txt

Filesize
143B

MD5
f2305c94dba681e1451e63e16276ce45

SHA1
03b72efb0c1e8e374eddf135a23165f5c14b246e

SHA256
945860367944b1bc68531f3a545d6f05951e5a59b1ddd4c77072ab61cd68f584

SHA512
c7da402712a36ea6a5b1856a41712aa886390eb2ad1daa4f45c3067d5d5da055508f7e8888ec764f33dbb313ed74fb9c15f751092e6fbc9ea5a1390adadac8be

Download Submit