6cdb32b263eecaee8caba03d9673602bcb88185c228ba69f11d187524f7fd85d

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

28bbf85be4ef3ddce1924338e64f51d8_JaffaCakes118.exe
Size

19KB
MD5

28bbf85be4ef3ddce1924338e64f51d8
SHA1

1b797902906b4e31a638504e7a705a11da771a65
SHA256

6cdb32b263eecaee8caba03d9673602bcb88185c228ba69f11d187524f7fd85d
SHA512

01ada7b4ef19c8ebaea35ea176b76e281d58c7e8e7f7288468ac3df19e7c10df590f7e89afcb65729de2531b76c7597335cf79dc2d317da420b6ffde9c7b1edd
SSDEEP

384:PwB2+bhlJTC6H03If9CTriGh/hQxjacyWqT0lFen2sZleaUbu:1+bJTJ8If97qQxOhWq4lFen2seaUbu

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2352	kernel33.exe

Loads dropped DLL 3 IoCs

pid	Process
2036	28bbf85be4ef3ddce1924338e64f51d8_JaffaCakes118.exe
2036	28bbf85be4ef3ddce1924338e64f51d8_JaffaCakes118.exe
2352	kernel33.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kernel33.exe"	kernel33.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2352	kernel33.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2352	2036	28bbf85be4ef3ddce1924338e64f51d8_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2352	2036	28bbf85be4ef3ddce1924338e64f51d8_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2352	2036	28bbf85be4ef3ddce1924338e64f51d8_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2352	2036	28bbf85be4ef3ddce1924338e64f51d8_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\28bbf85be4ef3ddce1924338e64f51d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28bbf85be4ef3ddce1924338e64f51d8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\kernel33.exe
  C:\Users\Admin\AppData\Local\Temp\kernel33.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\She1132.dll

Filesize
13KB

MD5
558d94bfc1470e8a85c325827d8c02c3

SHA1
d62265bf65db1a3fc5ecb1a45c35b9702dcb9ee7

SHA256
90e3f2ea06b0cc8ed653e201fde8c6d8bc81ed01f9510ced21ff0cc1c210e833

SHA512
5143debed1ffb33db396204436f9517ea4e3c697c00fe63f3164b5b8f3d2578159a89b7845549f9387a4c1dcc9948c02b308a504700c1343e8a6367fea9c3e6d

Download Submit
\Users\Admin\AppData\Local\Temp\kernel33.exe

Filesize
19KB

MD5
28bbf85be4ef3ddce1924338e64f51d8

SHA1
1b797902906b4e31a638504e7a705a11da771a65

SHA256
6cdb32b263eecaee8caba03d9673602bcb88185c228ba69f11d187524f7fd85d

SHA512
01ada7b4ef19c8ebaea35ea176b76e281d58c7e8e7f7288468ac3df19e7c10df590f7e89afcb65729de2531b76c7597335cf79dc2d317da420b6ffde9c7b1edd

Download Submit
memory/2352-13-0x0000000000230000-0x0000000000248000-memory.dmp

Filesize
96KB

Download
memory/2352-14-0x0000000000230000-0x0000000000248000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads