35552ec91930abd1093c02c3de9eb9774c55159fb1fa701a40207bae56c8cb5f

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

303cc963f35aa899921ae10f705b5557_JaffaCakes118.exe
Size

56KB
MD5

303cc963f35aa899921ae10f705b5557
SHA1

3a15c3e631f3b206d23d0d79fc5fa08e27f00ed3
SHA256

35552ec91930abd1093c02c3de9eb9774c55159fb1fa701a40207bae56c8cb5f
SHA512

bf7d8c3c90d16cd3b9be9ebbc25041b4a529aae5cfa05bc53467244960675a83800a9f6e058d1b7eef260e3759e4444ffd1db03ae778fd816dc3403694eb6eba
SSDEEP

1536:2W1uBPtkyN1x4iDZkpY8ibNvU2bfIkdKtvkRc:6qk4ite/2Vd/y

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wdevknqv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\icurOPcPUf = "C:\\ProgramData\\kbylalmb\\wdevknqv.exe"	wdevknqv.exe

Executes dropped EXE 1 IoCs

pid	Process
3020	wdevknqv.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4088	303cc963f35aa899921ae10f705b5557_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 3020	4088	303cc963f35aa899921ae10f705b5557_JaffaCakes118.exe	87
PID 4088 wrote to memory of 3020	4088	303cc963f35aa899921ae10f705b5557_JaffaCakes118.exe	87
PID 4088 wrote to memory of 3020	4088	303cc963f35aa899921ae10f705b5557_JaffaCakes118.exe	87
PID 4088 wrote to memory of 4516	4088	303cc963f35aa899921ae10f705b5557_JaffaCakes118.exe	88
PID 4088 wrote to memory of 4516	4088	303cc963f35aa899921ae10f705b5557_JaffaCakes118.exe	88
PID 4088 wrote to memory of 4516	4088	303cc963f35aa899921ae10f705b5557_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\303cc963f35aa899921ae10f705b5557_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\303cc963f35aa899921ae10f705b5557_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4088
- C:\ProgramData\kbylalmb\wdevknqv.exe
  C:\ProgramData\kbylalmb\wdevknqv.exe
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  PID:3020
- C:\Windows\SysWOW64\cmd.exe
  /c del /f C:\Users\Admin\AppData\Local\Temp\303CC9~1.EXE.bak >> NUL
  2⤵
  PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\kbylalmb\wdevknqv.exe

Filesize
56KB

MD5
303cc963f35aa899921ae10f705b5557

SHA1
3a15c3e631f3b206d23d0d79fc5fa08e27f00ed3

SHA256
35552ec91930abd1093c02c3de9eb9774c55159fb1fa701a40207bae56c8cb5f

SHA512
bf7d8c3c90d16cd3b9be9ebbc25041b4a529aae5cfa05bc53467244960675a83800a9f6e058d1b7eef260e3759e4444ffd1db03ae778fd816dc3403694eb6eba

Download Submit
memory/4088-4-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads