57c063ce0d74fa88098e39a66e7026fd77b89d1aaa06f4c0605d3eeca4a880e2

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34ab77f685681ef1bdea9b5d4fd4c579_JaffaCakes118.exe
Size

217KB
MD5

34ab77f685681ef1bdea9b5d4fd4c579
SHA1

0463614de80dd86d5b7fd5bf9b82a6e5ddc89128
SHA256

57c063ce0d74fa88098e39a66e7026fd77b89d1aaa06f4c0605d3eeca4a880e2
SHA512

422e14474e55776f867e2a6ab8e4b494a60654425a42189f1da0e40c00105361acc1d9f6f55fdbe915427c65908f7f0452a66837e3d4cf61793344c4191480d9
SSDEEP

1536:GCbL6VujTlCpET2q/CD1zlfp9ouwg1Gxrb7hjWzspk1IKcNjlyawc3qZHAfn:GCbLSYd/+Rlfjf1Qb7hjWzs+1vcFlpSO

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,New Folder.exe"	34ab77f685681ef1bdea9b5d4fd4c579_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\New Folder = "New Folder.exe"	34ab77f685681ef1bdea9b5d4fd4c579_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\New Folder.exe	34ab77f685681ef1bdea9b5d4fd4c579_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\New Folder.exe	34ab77f685681ef1bdea9b5d4fd4c579_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2180	34ab77f685681ef1bdea9b5d4fd4c579_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\34ab77f685681ef1bdea9b5d4fd4c579_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\34ab77f685681ef1bdea9b5d4fd4c579_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\New Folder.exe

Filesize
217KB

MD5
34ab77f685681ef1bdea9b5d4fd4c579

SHA1
0463614de80dd86d5b7fd5bf9b82a6e5ddc89128

SHA256
57c063ce0d74fa88098e39a66e7026fd77b89d1aaa06f4c0605d3eeca4a880e2

SHA512
422e14474e55776f867e2a6ab8e4b494a60654425a42189f1da0e40c00105361acc1d9f6f55fdbe915427c65908f7f0452a66837e3d4cf61793344c4191480d9

Download Submit
C:\yahoopath.txt

Filesize
36B

MD5
a1591811a763a0879f97d3eb38518489

SHA1
c26489aa90aefa267e273691aa63d946a3057673

SHA256
49ad7378011464ad0f6ea8c0df71364492909df187dc681c2574a9cbcbe4671b

SHA512
9340ae7b594d342a69af03096fbd0d863a513ad467a0baf54db3850c455b2b66a5cd6f7668bbbec3331cbc9d86218ffff81df9acd4de48a4c743feb7c8d544c6

Download Submit
memory/2180-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads