8c489230b9a684a16180899ae2b8e89059d276f3598df780397e6194de4e9b2d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

312df2c367cee944852335eab6e2a04f_JaffaCakes118.exe
Size

19KB
MD5

312df2c367cee944852335eab6e2a04f
SHA1

3fc7ba31f96a4322d707b44430c446735cb717d0
SHA256

8c489230b9a684a16180899ae2b8e89059d276f3598df780397e6194de4e9b2d
SHA512

feef22c8ed93536e4e41812af6cf8ccb020cd806652093b381c74c64c7f82553870a58710a3299f7d98134e2bc7c5bb06657158db59bb51884d64b6e4d0fec0b
SSDEEP

384:a0qYE38hIxuA+Qjsh8KRJqfyqPVpn4t3Bh:FKGIxR+lfzqdVp4t33

Score

1^/10

Malware Config

Signatures

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	312df2c367cee944852335eab6e2a04f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	312df2c367cee944852335eab6e2a04f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2624	312df2c367cee944852335eab6e2a04f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	312df2c367cee944852335eab6e2a04f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\312df2c367cee944852335eab6e2a04f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\312df2c367cee944852335eab6e2a04f_JaffaCakes118.exe"
1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~!#222E.tmp

Filesize
10KB

MD5
51c86a5c504c3c14795b90cdf24e5feb

SHA1
5aefee8f23753b9841b094c72907226ee899665b

SHA256
a0f078d0485f6b83a81257040259572e71d7e57d9ccd0f03e675221f83a89fde

SHA512
359b16336917c52ea71a28b971ceea3dfc7a327ca79dedc3eea46492a40892e2d166ecca9d15761c29691b17a21d8dc91279098a9ab7e5c0faf7781046c421a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#269C.tmp

Filesize
9KB

MD5
8b637573d98800cc9693c70e337e34ef

SHA1
c6a0ae05ee5ad689f3d458ff2114d874620caa08

SHA256
2b7e5de7aa781727bf253f6e8e75426885ab8a5b0be177e1a1b87fd354c3dff4

SHA512
b468ae9e8917e038cc4d99669978414e8b022e2344554cd92ebfa74e3500a7d8ff0f990af7cc889e886354504ad5ba350c9f1c2675946c51067572c04ec7e689

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#332B.tmp

Filesize
4KB

MD5
907721879c907337535693931f3b8b0b

SHA1
f6845d9b99fc72e51e399cd48e2f9dee04a36934

SHA256
37de78cdb2569289fa766f2cb0d4daf5b8b56eff765310d0b91eda4d515d003f

SHA512
51eab867735ee9996222a93f42b49d27e3556e17990a7f5a1cf01249f759aa63c1252fae45198ac7e20ab02a0f746303494faa27fc0c59e0bc8dde0421330056

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#3E9C.tmp

Filesize
10KB

MD5
4014b1952c988f6075e37595c552cbbb

SHA1
cb016c6138d16e03d80d3d446dd1286e1decb496

SHA256
9bc65228aebfa471288c2d10bb7e6eac4ae202985adeeccc37f714ba3cede5f3

SHA512
a89b9437529a11547680006b4fb931bf536db1086637443c953ff2511ce9df1fb2fd8fbad846264c5ebd94af699692822033598028acd3bd1c44325c9cd5a7a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#51B1.tmp

Filesize
13KB

MD5
70c7be5b8b96458546224a6c6b7b20a2

SHA1
464c60f4d62a309729d19fac68556d8a9768ddf1

SHA256
d8031d4b4ded9c20eb41d13faed4229bf245b5de1f3ec62c3a0bbd36f2fd4ad5

SHA512
f7540f1698684f9a2db1c3b1454b682d01fed3752245a614be79c0f7bc692a70fe8c1f0e5adf3a8c3191cd819ef17652ab70d98f662f9623fba2bc18204a1b22

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#5A19.tmp

Filesize
4KB

MD5
ab5ec98bbb5e6434d2ddb83f0023152d

SHA1
b3c9c40f1c2841180c5575295de7758e4ef7d137

SHA256
862ab1a1fe82f33a0813e81158a773d96ddca2e531d351768ab95d49a074637a

SHA512
f23f9450b5df48d9b9e0def5ab9be50ffcb54ff3eecfe15ddb334cdf3342ca161823e84413066f25fe5d4adf193f183cbcbe1919174b55d907beaa29edf092af

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#6002.tmp

Filesize
4KB

MD5
f6cf7394802b5ef61f0edf4b9eaacba3

SHA1
cf23b1601cae146c94aab4fed4e3cab5cf2eee4e

SHA256
b20b5f4f74ec6680f186ec0a107dc33f0243dd2fccfb8bc76b9e5858d67970a5

SHA512
50f5d498f49b1951b14273e13baaa4949166bafa9910be8fbcdd2f602469bbffd3dc7a6a63996c1c06ede5a0ce4c1419636149e1e3d7766d71c18b239dc8f92a

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#62F7.tmp

Filesize
10KB

MD5
6d95dbd654834d17d97659e3350444da

SHA1
de4a060afa48b5af1207b6662cf1167f73c88a45

SHA256
ee508c7bac5a53cf1d54ffd432b0a5cb826aff35abe77f85cad1298d25c3a298

SHA512
ce6c484c5ba1739490b104554262bc4e2ccae522d7847dceb0ea5881130e883586aa0d8893c1d6c926c1836608b286d0dcb500698893814c260924f25a5d59d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#6490.tmp

Filesize
22KB

MD5
28ad755ef7fb1e9507e4a6a55cbf10a7

SHA1
36a5cede32814f59713576bec729e5a99b3aba5e

SHA256
227e033a4f0d0e5172fa8ee30c33a3fa6e67a2a11a59e9274e7192bb96f2b032

SHA512
90fa3f80a8fd085f7f27aec181ed2439d815b64a0eb5b2f8ef36b51b2a570adc6e3a83dfe7a99629a47c137047d2a0c32a233b5e3941587e54761aaf2c4a1129

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#6C43.tmp

Filesize
6KB

MD5
ebfb5f358645df38f609e74d99d30700

SHA1
5e72f33b817ec82bc4388cced18b439efebca08b

SHA256
966efa0238c676515e539cc5b3bab2017808ea70797503df99c6444303f98abb

SHA512
aedaf0ce5840d473075d91c323d75b64a50122f02e7afef9091d5d580681b19ddcef37628fa1f991dea7520f3d742126ba934eac6c836ca8414de5fedb217753

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#6E0A.tmp

Filesize
149KB

MD5
d9c8bb0f5d53bd63d752a23854c6bf1e

SHA1
20a469b0ab728b77412f3533e14e74257a280849

SHA256
9a843ba3b457821304ad43e079cc6cae8ac62f730266a2d2ede38dae4267fc9d

SHA512
58ce9a413a2e1943be790b6cecec9f4eb2f82c830a5244d45318e1b4fc9380f334b6fe186a912eb4980a19be071b7526989280b08d9fa3cbbe51b81f793fc9cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#7307.tmp

Filesize
7KB

MD5
265320c617281418ee5a0eeb0eedf9ad

SHA1
ec2722221f513f22a7e54269a671b2c091ea2212

SHA256
fd28fec5bdf88064569fb7173b924b35ed5741b7df4b203b4bef0ba4abade769

SHA512
c565e39d936cef6a5d49844d06792bbd68f3008d691684372df1c33d98e96146042dc77083ed227e33c5b6c435d26dab27a86807fde7b59cc0dd41513fdd55a2

Download Submit
memory/2624-213-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/2624-0-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download