30ed4d71ba8e068646ec8fed464e7a7815fe5b7364f00b77355b4add221e955e

Analysis

max time kernel
106s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 08:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2facccd29ff39a77000a16cef14650eb_JaffaCakes118.exe
Size

42KB
MD5

2facccd29ff39a77000a16cef14650eb
SHA1

48ec866c31d7bb100183a82611196ce410f43bc2
SHA256

30ed4d71ba8e068646ec8fed464e7a7815fe5b7364f00b77355b4add221e955e
SHA512

3c64475c62f62b48cf527fd5adc98fa8c06d09c544d279081f92ce57314a6a9df2f166600c84fd5dfe9dcaec3d531429b6e1650f7a33acacc574add48f72a109
SSDEEP

768:xu6THgVNE4YYo+eRt4n9aOJnCrh6JkZVqcgg1zhZai6WivD4rdj8Q3y8:xuWgHEpYo+egn9gV6JqVEAZaF4rhhy8

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WoMGNX1n28 = "C:\\ProgramData\\lgbgxgfq\\bsbwdchg.exe"	bsbwdchg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	bsbwdchg.exe

Executes dropped EXE 1 IoCs

pid	Process
1592	bsbwdchg.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1464	2facccd29ff39a77000a16cef14650eb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1592	1464	2facccd29ff39a77000a16cef14650eb_JaffaCakes118.exe	88
PID 1464 wrote to memory of 1592	1464	2facccd29ff39a77000a16cef14650eb_JaffaCakes118.exe	88
PID 1464 wrote to memory of 1592	1464	2facccd29ff39a77000a16cef14650eb_JaffaCakes118.exe	88
PID 1464 wrote to memory of 1596	1464	2facccd29ff39a77000a16cef14650eb_JaffaCakes118.exe	89
PID 1464 wrote to memory of 1596	1464	2facccd29ff39a77000a16cef14650eb_JaffaCakes118.exe	89
PID 1464 wrote to memory of 1596	1464	2facccd29ff39a77000a16cef14650eb_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\2facccd29ff39a77000a16cef14650eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2facccd29ff39a77000a16cef14650eb_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1464
- C:\ProgramData\lgbgxgfq\bsbwdchg.exe
  C:\ProgramData\lgbgxgfq\bsbwdchg.exe
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  PID:1592
- C:\Windows\SysWOW64\cmd.exe
  /c del /f C:\Users\Admin\AppData\Local\Temp\2FACCC~1.EXE.bak >> NUL
  2⤵
  PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\lgbgxgfq\bsbwdchg.exe

Filesize
42KB

MD5
2facccd29ff39a77000a16cef14650eb

SHA1
48ec866c31d7bb100183a82611196ce410f43bc2

SHA256
30ed4d71ba8e068646ec8fed464e7a7815fe5b7364f00b77355b4add221e955e

SHA512
3c64475c62f62b48cf527fd5adc98fa8c06d09c544d279081f92ce57314a6a9df2f166600c84fd5dfe9dcaec3d531429b6e1650f7a33acacc574add48f72a109

Download Submit
memory/1464-4-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads