550854f869a9a9011e940d31547a1f0f6981ec6cb0cd9c7ed896c8493f1df23b

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe
Size

15KB
MD5

345e6232213f3abe4975c76b40611f2f
SHA1

5781b4259d366df2fc2e277e7d61c55e1fc8fc0b
SHA256

550854f869a9a9011e940d31547a1f0f6981ec6cb0cd9c7ed896c8493f1df23b
SHA512

dd803afa43a5ff1cd7b25b133058fa0bbf69ecfebb893e01af7fa291e76cfc444388a45563e00549e43d4824f16acef99889c382e4b12767e4a5d5d7cf22db90
SSDEEP

384:I6ZBnuaL5Alwcj4uNCMZ4u0VdQP6YI5BO70:I6ZtW4uNCMjyRB

Score

8^/10

persistence privilege_escalation upx

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4796	qzyerdk.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1100-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/files/0x000800000002347a-4.dat	upx
behavioral2/memory/4796-6-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/1100-9-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qzyerd.dll	345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\qzyerdk.exe	345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\qzyerdk.exe	345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 4796	1100	345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe	83
PID 1100 wrote to memory of 4796	1100	345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe	83
PID 1100 wrote to memory of 4796	1100	345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe	83
PID 1100 wrote to memory of 2060	1100	345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe	87
PID 1100 wrote to memory of 2060	1100	345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe	87
PID 1100 wrote to memory of 2060	1100	345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\qzyerdk.exe
  C:\Windows\system32\qzyerdk.exe t!
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe.bat
  2⤵
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\345e6232213f3abe4975c76b40611f2f_JaffaCakes118.exe.bat

Filesize
210B

MD5
864ffb23932e19650d6e5dad3072ee98

SHA1
044c14eaaf35db1eef36e060276ae36cb3603c7a

SHA256
1c3e0ccc48453ae62e2cbb2c5e52c0e0b4165a1d533a337f6c3e42e35f242ec1

SHA512
fd8fa65d23ff2b92272ad709f520db187a485074ffccd8e34a4b6777ef71fbbf7b9f6de59c4db456a936007aaba01d33e0c0c51cae14a7e6f103713386c4b822

Download Submit
C:\Windows\SysWOW64\qzyerdk.exe

Filesize
15KB

MD5
345e6232213f3abe4975c76b40611f2f

SHA1
5781b4259d366df2fc2e277e7d61c55e1fc8fc0b

SHA256
550854f869a9a9011e940d31547a1f0f6981ec6cb0cd9c7ed896c8493f1df23b

SHA512
dd803afa43a5ff1cd7b25b133058fa0bbf69ecfebb893e01af7fa291e76cfc444388a45563e00549e43d4824f16acef99889c382e4b12767e4a5d5d7cf22db90

Download Submit
memory/1100-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1100-9-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4796-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download