6d3f36163e047f83671b5597dcfeb0983b4a0985ee5ff71373382b455c6f2609

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Size

21KB
MD5

348c5d58567418b434d2dd465279cc6f
SHA1

cbb6524624e232e5e23aa44d219f3282346bc27c
SHA256

6d3f36163e047f83671b5597dcfeb0983b4a0985ee5ff71373382b455c6f2609
SHA512

e7ce63f8a13ede2481a2be06087a56081335d6b1490cfe105c1b1bc93ea41282b3e2d5d9861f89eac3297204689c2fa696987fca24bcd5a2fb5ac947f3377840
SSDEEP

384:SKwstfwX/Qxno1nrJhERk0FwiKYMAUY6R6pBg5D/j1x+ymxvDFe98OoxD5UpGdDo:SDst8/QtIrHERkMEBAVq6pBghbr+hFuH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2064	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wzcfsw.dll	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\tf0	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wzcfsw.dll.LoG	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28766E1C-74B0-4417-8C75-F12AE309EF35}\InProcServer32	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28766E1C-74B0-4417-8C75-F12AE309EF35}\InProcServer32\ = "C:\\Windows\\SysWow64\\wzcfsw.dll"	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS\	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28766E1C-74B0-4417-8C75-F12AE309EF35}	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28766E1C-74B0-4417-8C75-F12AE309EF35}\ = "MICROSOFT"	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28766E1C-74B0-4417-8C75-F12AE309EF35}\InProcServer32\ThreadingModel = "Apartment"	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2064	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	2064	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Token: SeRestorePrivilege	2064	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Token: SeBackupPrivilege	2064	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
Token: SeRestorePrivilege	2064	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2064	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
2064	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
2064	348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\348c5d58567418b434d2dd465279cc6f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\wzcfsw.dll

Filesize
259KB

MD5
4afb3b97b7fa0bc28afffce5ca41dd06

SHA1
07c34480f94d44e0357f99b51f40661db1744b9e

SHA256
8e737c251157b0efa125ebc3ae203f10edbe1dfe53281103b81140bc9ecd8bd4

SHA512
e25f73486c954056dd3474f9b47e83b2f57b809b5826c0626fdc9cd24f8cfd4701b0cac98bf5094a3148cd64ff50f5bb073c25f22552011efaca6f7d1de36f70

Download Submit
memory/2064-2-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/2064-5-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download