89c9b4e30d6be8d85fa4ba73a76934d7daec6280dc4997774d3f7ada4b065df8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Size

19KB
MD5

278fba1cd94e1a1811a8512284804026
SHA1

46a4479332db9c0bfd19271efcfc022365d8fea3
SHA256

89c9b4e30d6be8d85fa4ba73a76934d7daec6280dc4997774d3f7ada4b065df8
SHA512

04700519bb11b1a91b87c07d86a1d42a4e4ce1f2b1cbb7365521bfc905b21ab7773340c2bd52907a4c0278b023a54c5ba0cc2aab534b91a42220023f4cb306e7
SSDEEP

384:rLgVXkDsz3ffGx6HG9qkQtlxZXCfIJC5vlKcq3i/cAY:rLgRk2PfGqG4kQnXCMCPGyUAY

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\œ„Ðn.dll	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\tf0	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\œ„Ðn.dll.LoG	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\InProcServer32	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\InProcServer32\ThreadingModel = "Apartment"	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\ = "MICROSOFT"	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\InProcServer32\ = "C:\\Windows\\SysWow64\\œ„Ð\u0090\x10n.dll"	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS\	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2320	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	2320	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Token: SeRestorePrivilege	2320	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Token: SeBackupPrivilege	2320	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
Token: SeRestorePrivilege	2320	278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\278fba1cd94e1a1811a8512284804026_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2320

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads