cbb0d05ea9f63c961f4ce449ec21bf34d2eef62ed9fc48cde15ed59ed0f6012b

Analysis

max time kernel
149s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

298797f994965f7606ee880cf6457582_JaffaCakes118.exe
Size

383KB
MD5

298797f994965f7606ee880cf6457582
SHA1

3883ab0bb4b3d9b31709beba43c2b56bedb69165
SHA256

cbb0d05ea9f63c961f4ce449ec21bf34d2eef62ed9fc48cde15ed59ed0f6012b
SHA512

67732ad30aac78eeebafa2209d4d21ebdb17589d37adf9ceb9807d0d5e6c3b3cf2f2a5aa6a9ff590d4eccbc35587c47933e6781131c90621e8614743000c03bc
SSDEEP

6144:LFBP2ahwDcLew2I2Ad7oyF3z/b2DdL0Pb9NABmkQKcTWZv/6yblTedJaf2X:L9CDM2k3HCsN6JcTWZKwDf2

Score

7^/10

persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1172	iDgOj10800.exe

Executes dropped EXE 1 IoCs

pid	Process
1172	iDgOj10800.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/980-2-0x0000000000400000-0x00000000004B49FD-memory.dmp	upx
behavioral2/memory/980-1-0x0000000000400000-0x00000000004B2000-memory.dmp	upx
behavioral2/memory/1172-12-0x0000000000400000-0x00000000004B49FD-memory.dmp	upx
behavioral2/memory/980-15-0x0000000000400000-0x00000000004B49FD-memory.dmp	upx
behavioral2/memory/980-16-0x0000000000400000-0x00000000004B49FD-memory.dmp	upx
behavioral2/memory/980-17-0x0000000000400000-0x00000000004B2000-memory.dmp	upx
behavioral2/memory/1172-18-0x0000000000400000-0x00000000004B49FD-memory.dmp	upx
behavioral2/memory/1172-24-0x0000000000400000-0x00000000004B49FD-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iDgOj10800 = "C:\\ProgramData\\iDgOj10800\\iDgOj10800.exe"	iDgOj10800.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	980	298797f994965f7606ee880cf6457582_JaffaCakes118.exe
Token: SeDebugPrivilege	1172	iDgOj10800.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1172	iDgOj10800.exe
1172	iDgOj10800.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1172	iDgOj10800.exe
1172	iDgOj10800.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1172	iDgOj10800.exe
1172	iDgOj10800.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 1172	980	298797f994965f7606ee880cf6457582_JaffaCakes118.exe	85
PID 980 wrote to memory of 1172	980	298797f994965f7606ee880cf6457582_JaffaCakes118.exe	85
PID 980 wrote to memory of 1172	980	298797f994965f7606ee880cf6457582_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\298797f994965f7606ee880cf6457582_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\298797f994965f7606ee880cf6457582_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980
- C:\ProgramData\iDgOj10800\iDgOj10800.exe
  "C:\ProgramData\iDgOj10800\iDgOj10800.exe" "C:\Users\Admin\AppData\Local\Temp\298797f994965f7606ee880cf6457582_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\iDgOj10800\iDgOj10800.exe

Filesize
383KB

MD5
9151319f4243294768c220c3cec83a29

SHA1
bd42dd0d1e3614891e0f7d08185b195199e1cb8a

SHA256
cd37b4f2a63b46d2f0b2b3ab631f5c9a5c8662319b5624a0689828a28cbc59fa

SHA512
5c60aa72027fe8ae0b9402c2e22c30ac140eed4c9a6a4f6c201d7d0d65148adef34ddc3ec50c10c76b131c601968d4b64085bb1dd9b9260c7c413b967ec19c12

Download Submit
memory/980-2-0x0000000000400000-0x00000000004B49FD-memory.dmp

Filesize
722KB

Download
memory/980-1-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/980-15-0x0000000000400000-0x00000000004B49FD-memory.dmp

Filesize
722KB

Download
memory/980-16-0x0000000000400000-0x00000000004B49FD-memory.dmp

Filesize
722KB

Download
memory/980-17-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1172-12-0x0000000000400000-0x00000000004B49FD-memory.dmp

Filesize
722KB

Download
memory/1172-18-0x0000000000400000-0x00000000004B49FD-memory.dmp

Filesize
722KB

Download
memory/1172-24-0x0000000000400000-0x00000000004B49FD-memory.dmp

Filesize
722KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads