0b9047a60b492d03eaf774020efba43fba0b47bf84cd615b43a024b69658fb45

Analysis

max time kernel
150s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

254d68d8792ce9ecd18a2f2243dc0114_JaffaCakes118.exe
Size

16KB
MD5

254d68d8792ce9ecd18a2f2243dc0114
SHA1

c0bcc3749f45a3b6c1a326ddbf936a7526e8bed2
SHA256

0b9047a60b492d03eaf774020efba43fba0b47bf84cd615b43a024b69658fb45
SHA512

07a4c15d7764307bd799d7a4a1d60e8cf0164be760aaf569ccf0057dfc5ed19e0164fe08c0f6adce553cc32c130e68d4e00b436249e64a1287fdfed41d6f4edf
SSDEEP

384:NJKMHwRqUFmwTiVukaMpzj8uMp7XHc5jlMtZ2ESuMMpk+C:LXQRqIWVuk/pvrMpbHcotQPMpk+

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1924	254d68d8792ce9ecd18a2f2243dc0114_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DbgHlp32 = "C:\\Windows\\DbgHlp32.exe"	254d68d8792ce9ecd18a2f2243dc0114_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DbgHlp32.dll	254d68d8792ce9ecd18a2f2243dc0114_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\DbgHlp32.exe	254d68d8792ce9ecd18a2f2243dc0114_JaffaCakes118.exe
File opened for modification	C:\Windows\DbgHlp32.exe	254d68d8792ce9ecd18a2f2243dc0114_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1924	254d68d8792ce9ecd18a2f2243dc0114_JaffaCakes118.exe
1924	254d68d8792ce9ecd18a2f2243dc0114_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1924	254d68d8792ce9ecd18a2f2243dc0114_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 3404	1924	254d68d8792ce9ecd18a2f2243dc0114_JaffaCakes118.exe	56
PID 1924 wrote to memory of 3404	1924	254d68d8792ce9ecd18a2f2243dc0114_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3404
- C:\Users\Admin\AppData\Local\Temp\254d68d8792ce9ecd18a2f2243dc0114_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\254d68d8792ce9ecd18a2f2243dc0114_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\DbgHlp32.dll

Filesize
26KB

MD5
667d26ccb8728de3e5a9c6a5cb134f52

SHA1
02b84a6df338fcb5911ac9e034eecaaeb776c80b

SHA256
03559912feec4166e245b8bcfac35572e61c0364e693cb2fb70329443b9240d9

SHA512
820d5df52c05e1ce4e4cfbe37955144b907767a9ac62ca838aeeb9424f5d8dd03c2b5b991f60ec8ce52fcb9f03a583811f7357f898e5aaaa80214b7580120979

Download Submit
memory/1924-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1924-10-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/1924-11-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1924-12-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/3404-3-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/3404-6-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/3404-4-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download