bec59a6b223ec9c4946545d0fbb8c971f9b55c0cedc304026f7eafeb0e115ebb

Analysis

max time kernel
93s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 19:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2d8cbfc2fe974459978c113c56e85699_JaffaCakes118.exe
Size

199KB
MD5

2d8cbfc2fe974459978c113c56e85699
SHA1

9b13a5867df81e9637cfacda09d034eaf520b333
SHA256

bec59a6b223ec9c4946545d0fbb8c971f9b55c0cedc304026f7eafeb0e115ebb
SHA512

723ce15e3b01754d785b989ba58690f751cdc8c770eb8ef56a75cb411e5a5c2f01caa46c3a0612f9bf01423490cf04beb07ab37b905cd8251c00d99ef8c2209e
SSDEEP

3072:vW+DiW9iLo+GnHjKBpjuRGvFBS+pV9Kn7VfET1v6ALEUroo60JYnV:+KELo7GjucTSekWiqp2nV

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3232	server2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2d8cbfc2fe974459978c113c56e85699_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3232	server2.exe
3232	server2.exe
3232	server2.exe
3232	server2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 3232	4120	2d8cbfc2fe974459978c113c56e85699_JaffaCakes118.exe	82
PID 4120 wrote to memory of 3232	4120	2d8cbfc2fe974459978c113c56e85699_JaffaCakes118.exe	82
PID 4120 wrote to memory of 3232	4120	2d8cbfc2fe974459978c113c56e85699_JaffaCakes118.exe	82
PID 3232 wrote to memory of 3424	3232	server2.exe	56
PID 3232 wrote to memory of 3424	3232	server2.exe	56
PID 3232 wrote to memory of 3424	3232	server2.exe	56
PID 3232 wrote to memory of 3424	3232	server2.exe	56
PID 3232 wrote to memory of 3424	3232	server2.exe	56
PID 3232 wrote to memory of 3424	3232	server2.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\2d8cbfc2fe974459978c113c56e85699_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2d8cbfc2fe974459978c113c56e85699_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server2.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server2.exe

Filesize
156KB

MD5
1efd365e7a60c9523270accbbb76d991

SHA1
8d44be95e87a9143f2fde73a548d043d13e013ba

SHA256
9528ede2a9746a3b85eab9b4ae43d58df98c624718103865e1892cd94fb22d46

SHA512
364446f12db81d71d505ae177db9b1638255659ab81bce50b87d782bdd4185087a66d90e3e340a22c4c77bd5de99d1f0da1b91db8a985cd546c28a7d4f34a8a8

Download Submit
memory/3232-5-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3232-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3232-6-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/3232-8-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/3424-9-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/3424-11-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download