85813571ca16d77248082a4daf301c0d850e5b903251987c2a1ce37f76872828

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
Size

68KB
MD5

3df36e30c8233e49709ae1b6c9856e9d
SHA1

7c80d0fabf50ea72926d33c2008a4948bce3373d
SHA256

85813571ca16d77248082a4daf301c0d850e5b903251987c2a1ce37f76872828
SHA512

c5392514c1e54ae0e8b3f91f695b370df6709cf2ab5caa1d49e05533b0fdf2995db3f2eabc7229f1c09e5ba4ac40752c830ba70dc12fb8c9de3f728d3e796d71
SSDEEP

1536:FNxU+W+73uSpoo3e/8+dcr2yS72WboWWW4Li:NU+W+qNo3e9Sy/9sWWWyi

Score

8^/10

persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\system32\\\\services.exe"	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rnsa30 = "C:\\Windows\\system32\\.exe"	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\W	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\J\scservice.exe	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\W\rnsa30.exe	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\J\servicess.exe	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\J\mirror.exe	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\J\netdhcp.exe	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J\netdhcp.exe	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J\scservice.exe	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\W\rnsa30.exe	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J\servicess.exe	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\J\mirror.exe	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4984	3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3df36e30c8233e49709ae1b6c9856e9d_JaffaCakes118.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\W\rnsa30.exe

Filesize
68KB

MD5
3043c2a80dd36b461de00cf20a528c70

SHA1
0c3fe32ce041d87f6b1f52e33c7cf71e8c43de11

SHA256
eac659e6b935ebaf4bf1140692e98d99b5b2b4268084872d1ec8195497c9dcae

SHA512
959971786f1c18f78b9537c00a2b96473f106972fb42f3e8c07dadf6c388ba5eef9dcc53161e980e72590b6ef6fd94c033316fda90593a9fca9ebc5c724d8c43

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads