551a842bf21e87573f3b876ef3b2886ca9f8fe4ef477c7f5c466d1b982f2d25d

Analysis

max time kernel
131s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

24f6c74f43ce4d408406b0bdbf3b5275_JaffaCakes118.exe
Size

44KB
MD5

24f6c74f43ce4d408406b0bdbf3b5275
SHA1

656ee9c558c75d2996ba5cf6b0473efb8de71587
SHA256

551a842bf21e87573f3b876ef3b2886ca9f8fe4ef477c7f5c466d1b982f2d25d
SHA512

ac4517dbf00114ba46591420e501a600da05150b3943b93f744f561551bc3362c32cb4a1236558d5ab22aa6ebdf84815774742f4242e616b2c1f02e322aad0d6
SSDEEP

768:YVIkS1E6as/o4eI/3xnTC9lP0sh9H/Obpv7wE:YVIkSEs/o4+3jH/W77

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3672	regedit32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateSys = "c:\\windows\\system32\\regedit32.exe"	24f6c74f43ce4d408406b0bdbf3b5275_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdRegistry = "c:\\windows\\system32\\regedit32.exe"	24f6c74f43ce4d408406b0bdbf3b5275_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\regedit32.exe	24f6c74f43ce4d408406b0bdbf3b5275_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3672	regedit32.exe
3672	regedit32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2516	24f6c74f43ce4d408406b0bdbf3b5275_JaffaCakes118.exe
2516	24f6c74f43ce4d408406b0bdbf3b5275_JaffaCakes118.exe
3672	regedit32.exe
3672	regedit32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 3672	2516	24f6c74f43ce4d408406b0bdbf3b5275_JaffaCakes118.exe	82
PID 2516 wrote to memory of 3672	2516	24f6c74f43ce4d408406b0bdbf3b5275_JaffaCakes118.exe	82
PID 2516 wrote to memory of 3672	2516	24f6c74f43ce4d408406b0bdbf3b5275_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\24f6c74f43ce4d408406b0bdbf3b5275_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\24f6c74f43ce4d408406b0bdbf3b5275_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- \??\c:\windows\SysWOW64\regedit32.exe
  c:\windows\system32\regedit32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\regedit32.exe

Filesize
44KB

MD5
24f6c74f43ce4d408406b0bdbf3b5275

SHA1
656ee9c558c75d2996ba5cf6b0473efb8de71587

SHA256
551a842bf21e87573f3b876ef3b2886ca9f8fe4ef477c7f5c466d1b982f2d25d

SHA512
ac4517dbf00114ba46591420e501a600da05150b3943b93f744f561551bc3362c32cb4a1236558d5ab22aa6ebdf84815774742f4242e616b2c1f02e322aad0d6

Download Submit