828443752a8ad9c40ea7e817d9900de69b919bd9c5b9edd7bcc7ef8b05a9b8df

Analysis

max time kernel
30s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

341af022ed8b123ec64816a8a82984da_JaffaCakes118.exe
Size

141KB
MD5

341af022ed8b123ec64816a8a82984da
SHA1

80ca8d534a143eb4dee23ee6ff049d3e991b64de
SHA256

828443752a8ad9c40ea7e817d9900de69b919bd9c5b9edd7bcc7ef8b05a9b8df
SHA512

01ff6aaa4db3233089ab416dd9f9759c205a9b97dec468ea4d0d1f9c38066b817952f488747175e343247f3ca8d6120602b22e86dd0911727ed1627a06df4a7f
SSDEEP

3072:S7HmkrBPlybo+w+IbV6BhDh/gT68a6TXom6rwlZ624KG8CfNgsEErd1B:mrBPljz+IbUg/a6TYmIw+24F+sEmdr

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\ppt498v.sys	341af022ed8b123ec64816a8a82984da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\thj5sp5iw.sys	341af022ed8b123ec64816a8a82984da_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\thj5sp5iw.sys	341af022ed8b123ec64816a8a82984da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ppt498v.sys	341af022ed8b123ec64816a8a82984da_JaffaCakes118.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ppt498v\ImagePath = "system32\\drivers\\ppt498v.sys"	341af022ed8b123ec64816a8a82984da_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\thj5sp5iw\ImagePath = "system32\\drivers\\thj5sp5iw.sys"	341af022ed8b123ec64816a8a82984da_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\8r6fci0.dll	341af022ed8b123ec64816a8a82984da_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\8r6fci0.dll	341af022ed8b123ec64816a8a82984da_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
476	Process not Found
476	Process not Found

C:\Users\Admin\AppData\Local\Temp\341af022ed8b123ec64816a8a82984da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\341af022ed8b123ec64816a8a82984da_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Drops file in System32 directory
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3068-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3068-5-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3068-8-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3068-12-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads