4353946db1b75a44665f1d5b31ee8b8d22a244c1b3ff883bb5b8f721c6bf8d07

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

345594d950e75ee803712a800a2fd228_JaffaCakes118.exe
Size

11KB
MD5

345594d950e75ee803712a800a2fd228
SHA1

d61a9e0b899ae54340028e274a200e36c9ee8484
SHA256

4353946db1b75a44665f1d5b31ee8b8d22a244c1b3ff883bb5b8f721c6bf8d07
SHA512

3bd474bb74bcb3f7f4c9854401acb9a9b4aeda1956cac5fda3a0baa219dbbec2acc793d129f02367b47ba655ac7bdfd9eed0319c5afe67775c8dafbd7792af5d
SSDEEP

192:bl8ar7TJjaROkOEGELOGHcR3TInOibY+5fbw3uz3GuyvPZxQTGqap:bl70JGMFnOibJVcQ3Kn0TrY

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run	isnotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\kernel32.dll = "C:\\Windows\\SysWOW64\\isnotify.exe"	isnotify.exe

Deletes itself 1 IoCs

pid	Process
2608	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2484	isnotify.exe

Loads dropped DLL 2 IoCs

pid	Process
2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe
2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\isnotify.exe	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe
2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe
2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2484	2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2484	2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2484	2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2484	2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2608	2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	31
PID 2272 wrote to memory of 2608	2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	31
PID 2272 wrote to memory of 2608	2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	31
PID 2272 wrote to memory of 2608	2272	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\345594d950e75ee803712a800a2fd228_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\345594d950e75ee803712a800a2fd228_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\isnotify.exe
  C:\Windows\system32\isnotify.exe
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  PID:2484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\345594~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\isnotify.exe

Filesize
8KB

MD5
61289ef1f8837e03d5f48ec25b403b90

SHA1
eae8d5dfa66b02bd331d78b7b9a8734cebbbfe2f

SHA256
e812ab2c605faf7992171726baf6c0798a23d0205d4b660282399b5013c357c4

SHA512
c3046e2a5a2925b9104430e430dbe5da75e9efc22099a03117c688cb88783ef229f29917b95003c062674af9f1b07b5663168f4444ab97791b0914003dc9bae2

Download Submit