271eff9c7f8a88b2d3581375abd80ae40f3c439e719702ca24b40285ff8276b5

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 13:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
Size

69KB
MD5

2c919ac2f5736a4df23cf4c01e5b85bc
SHA1

beea7938e7f1ba336480da7cd9a2b14e52bc8dcd
SHA256

271eff9c7f8a88b2d3581375abd80ae40f3c439e719702ca24b40285ff8276b5
SHA512

ea0288de0553aa6ec4b68ebbd29b98b00bf1215ce511d300ecb79ff88e3c7bf092398723c775c6e81b61ac09273a0516a0c50c44544734e75c3ee1a2d1fa5648
SSDEEP

1536:+iR5BMkpR8/hKnEdn6qL+TSntSI6ctvtFdBHX4DwXHdDuhbytZ0kwrSX:sJhdn1LqkV

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Admin.exe

Executes dropped EXE 1 IoCs

pid	Process
2456	Admin.exe

Loads dropped DLL 2 IoCs

pid	Process
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe"	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe"	Admin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2456	Admin.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2456	Admin.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2456	Admin.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2456	Admin.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2456	Admin.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2456	Admin.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2456	Admin.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2456	Admin.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2456	Admin.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2456	Admin.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2456	Admin.exe
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2456	Admin.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
2456	Admin.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2456	2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2456	2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2456	2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2456	2160	2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c919ac2f5736a4df23cf4c01e5b85bc_JaffaCakes118.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\Admin.exe
  "C:\Users\Admin\Admin.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\Admin.exe

Filesize
69KB

MD5
8259fa73b8c2925812dae90447e75eb7

SHA1
bcaf99a6588d4f0be57870cf5b3b5db64547e357

SHA256
4c04f579f90474e9eae7e138756734242c606ed459e10c2195cb3be3371bd2f3

SHA512
ef2798e13b12687c3e470f8b8d49ac97a22488e6be9667554ff3fb15689e341327f7edfc20f2148608c65e538fc10c833fa6074afdcc03db640b85b76667a49a

Download Submit
memory/2160-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2160-8-0x0000000003940000-0x0000000003956000-memory.dmp

Filesize
88KB

Download
memory/2160-14-0x0000000003940000-0x0000000003956000-memory.dmp

Filesize
88KB

Download
memory/2160-19-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2160-20-0x0000000003940000-0x0000000003956000-memory.dmp

Filesize
88KB

Download
memory/2456-15-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2456-21-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download