c2a7529594c8683532001274cff34b0c32b29561c8894500cd435df089fe2056

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a3f2620202c2afb7b7cc958875d6847_JaffaCakes118.exe
Size

29KB
MD5

3a3f2620202c2afb7b7cc958875d6847
SHA1

200160b26d84eb23efc9ba775879696ce404aa7e
SHA256

c2a7529594c8683532001274cff34b0c32b29561c8894500cd435df089fe2056
SHA512

11e479176554598bdb929e5a2ace797879a93b7747a2779d8c11b86b9ccf26a36e43346cf7c618c04ce19592b5df28bce0d09f31a9c57804827b8b798bb09247
SSDEEP

768:QSn9xLuTOobSVDQl8s65OGQMhys5o5eq2V44n/k:Qy9UTOsSVElE5O1MhD5zq2v8

Score

7^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Print Processors 1 TTPs 2 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
File created	C:\Windows\system32\spool\PRTPROCS\x64\xcE7aAAAA.dll	3a3f2620202c2afb7b7cc958875d6847_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\spool\PRTPROCS\x64\xcE7aAAAA.dll	3a3f2620202c2afb7b7cc958875d6847_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spool\PRTPROCS\x64\xcE7aAAAA.dll	3a3f2620202c2afb7b7cc958875d6847_JaffaCakes118.exe
File created	C:\Windows\system32\spool\PRTPROCS\x64\xcE7aAAAA.dll	3a3f2620202c2afb7b7cc958875d6847_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1356	3a3f2620202c2afb7b7cc958875d6847_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1356	3a3f2620202c2afb7b7cc958875d6847_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3a3f2620202c2afb7b7cc958875d6847_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a3f2620202c2afb7b7cc958875d6847_JaffaCakes118.exe"
1⤵
- Boot or Logon Autostart Execution: Print Processors
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-0-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/1356-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads