0529e80319219dd3187b48b44bcd851d7446acd1fc43c685fe92d3b6ea1e7d81

Analysis

max time kernel
134s
max time network
143s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe
Size

13KB
MD5

2e535d7010849b0948db82df9035f4a2
SHA1

526203dfc3f0641d8337db765e1c7895d025f140
SHA256

0529e80319219dd3187b48b44bcd851d7446acd1fc43c685fe92d3b6ea1e7d81
SHA512

cbfad8e96870ab77bf48960682bd9dc83f786870da432b2d5cf2495755841a8b37d11f00f3d6c37bca6cd9b1a29f4f4cd89ab496acb0992f53cdc90a475cabff
SSDEEP

192:4gPWgKRVzOJ4f9+hW+E1tWTUhOaQyzhRipwIFhg2n8cLZGxBEP4oyn0Fg7:4g+gqzOJf4QryzhQpjrgpcLZGxBq4am

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AENGFU3AA-B933-11d2-9CBD-0000F87A369E}	conime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AENGFU3AA-B933-11d2-9CBD-0000F87A369E}\ = "Ver933"	conime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AENGFU3AA-B933-11d2-9CBD-0000F87A369E}\stubpath = "C:\\WINDOWS\\Qedie\\conime.exe"	conime.exe

Deletes itself 1 IoCs

pid	Process
2308	conime.exe

Executes dropped EXE 1 IoCs

pid	Process
2308	conime.exe

Loads dropped DLL 1 IoCs

pid	Process
2468	2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	\??\c:\Program Files\933.txt	2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\Qedie\conime.exe	2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\Qedie\conime.exe	2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2468	1952	2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe	30
PID 1952 wrote to memory of 2468	1952	2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe	30
PID 1952 wrote to memory of 2468	1952	2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe	30
PID 1952 wrote to memory of 2468	1952	2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe	30
PID 2468 wrote to memory of 2308	2468	2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe	31
PID 2468 wrote to memory of 2308	2468	2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe	31
PID 2468 wrote to memory of 2308	2468	2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe	31
PID 2468 wrote to memory of 2308	2468	2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2e535d7010849b0948db82df9035f4a2_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\WINDOWS\Qedie\conime.exe
    C:\WINDOWS\Qedie\conime.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Deletes itself
    - Executes dropped EXE
    PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\Program Files\933.txt

Filesize
84B

MD5
4c24cb68339d21fc8fabeb07f2e85d7e

SHA1
486e7970bed2b151df25d46b6a3b01751c5acccf

SHA256
8be64de01c316064ced5e9cf11f29af9fdc3f5f9b0b2c1a9020f11d4ed671df7

SHA512
fc8529cb637aff3a8e4ec1d167c0670bcbbfd45a763abb1a46369f8f856e74266a48418ad45981ebb1924ea32c6fe13224abb2e273bc9d908425bfa94ade2826

Download Submit
\Windows\Qedie\conime.exe

Filesize
24KB

MD5
f25e90eedc460338588b65433827a074

SHA1
bdcbf8b2dc9a15401d4498580cc9335d4dd5e5db

SHA256
9ca1a22f59649d19b3101e3307772c6520d779ee2896e0d9ee9a169ae4b7c1e2

SHA512
5adbce9b6f6252569fe9c0cd81e40ff583ca958c7ed52543537d6e4306028399c59878fbdf8297ff6ee4944cee6a35d1e0b0298232d63fb16deb809682f866fc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads