e24a4c0fa1d7ea583e70d0275b8cb465fab0f2f20073685201232f974625422c

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 21:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe
Size 12KB
Sample240708-1j6myssfna
SHA256 e24a4c0fa1d7ea583e70d0275b8cb465fab0f2f20073685201232f974625422c
MD5 2de75cc088b661a67365ba10a493bab6
SHA1 41726f01bd8919767f5e75cee57a045bc5de9e27
SHA512 e23ae88427b588571c4a0b406527836a0054f874860474d653d2b8b194883a136b4ee5ce107509f146f5d7a961a10e896e7e14caacbfac28c649c682ec1a18bc
SSDEEP 192:h4RewhPGMhF/I2AkMDglt3oENEOI/mt+5ogdXaqX7BtqKyOoOx6evOo5hKDa/g:OrBF/I2ARgT3RNE9hha+FLaevO2xg
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence privilege_escalation upx

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2900	sctzxyk.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3508-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/files/0x000800000002348a-4.dat	upx
behavioral2/memory/3508-6-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/2900-7-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sctzxyk.exe	2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sctzxyk.exe	2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sctzxy.dll	2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 2900	3508	2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe	83
PID 3508 wrote to memory of 2900	3508	2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe	83
PID 3508 wrote to memory of 2900	3508	2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe	83
PID 3508 wrote to memory of 2812	3508	2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe	88
PID 3508 wrote to memory of 2812	3508	2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe	88
PID 3508 wrote to memory of 2812	3508	2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\SysWOW64\sctzxyk.exe
  C:\Windows\system32\sctzxyk.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe.bat
  2⤵
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\2de75cc088b661a67365ba10a493bab6_JaffaCakes118.exe.bat
Size 210B
SHA256 ed55e63aff553006e6de175c5674751788546c5f8a7b6173f04b3fcd4ba27cb2
MD5 f7e9c97c6a3cb4af97b2cf93974bcf09
SHA1 7c15e56daa2a7216853e4535502213a5986b9c7b
SHA512 2fa6dd76c8e062da732e0ab0d69f2a5efda0b4b3cf9ff5816a1a9f6ba7ee87fe7d7be63e1ab8be29403fae14039e47b41ceba5cf7f82f269009e9f8aba2923c4
MD5 SHA1 SHA512

Submit Download

sctzxyk.exe

Path C:\Windows\SysWOW64\sctzxyk.exe
Size 12KB
SHA256 e24a4c0fa1d7ea583e70d0275b8cb465fab0f2f20073685201232f974625422c
MD5 2de75cc088b661a67365ba10a493bab6
SHA1 41726f01bd8919767f5e75cee57a045bc5de9e27
SHA512 e23ae88427b588571c4a0b406527836a0054f874860474d653d2b8b194883a136b4ee5ce107509f146f5d7a961a10e896e7e14caacbfac28c649c682ec1a18bc
SSDEEP 192:h4RewhPGMhF/I2AkMDglt3oENEOI/mt+5ogdXaqX7BtqKyOoOx6evOo5hKDa/g:OrBF/I2ARgT3RNE9hha+FLaevO2xg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2900-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3508-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3508-6-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads