9efd39afd7249817d5a8acf4885a8a4b4d7310e77bb9b56d00729eaba7f8e779

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dd5ff069f235670aaf809da16a34c8b_JaffaCakes118.exe
Size

138KB
MD5

3dd5ff069f235670aaf809da16a34c8b
SHA1

2df5ce32a1b72dce3c80b241f0352c9f75293181
SHA256

9efd39afd7249817d5a8acf4885a8a4b4d7310e77bb9b56d00729eaba7f8e779
SHA512

d8984da717e9c3ced8a94d5ca2620927ba4d2068a73f1e2858753ab3fe461667035df548616e4f735f122ed416facb3e1e45a82a1ba983bfcc4103bd83b9c9fc
SSDEEP

3072:ss3QZfysrpU6ouYK+Zc/Uf7A3BZq8QajTGuCMKEhPEOj:syQhysrYZc/403BBaz0PEe

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1392	9BC3.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
1392	9BC3.tmp.exe

Loads dropped DLL 4 IoCs

pid	Process
1940	3dd5ff069f235670aaf809da16a34c8b_JaffaCakes118.exe
1940	3dd5ff069f235670aaf809da16a34c8b_JaffaCakes118.exe
1392	9BC3.tmp.exe
1392	9BC3.tmp.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\WAB = "C:\\Users\\Admin\\AppData\\Roaming\\Macromedia\\Common\\da3fe07619.exe"	9BC3.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll32.exe	9BC3.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1392	9BC3.tmp.exe
1392	9BC3.tmp.exe
1392	9BC3.tmp.exe
1392	9BC3.tmp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1392	9BC3.tmp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1392	1940	3dd5ff069f235670aaf809da16a34c8b_JaffaCakes118.exe	30
PID 1940 wrote to memory of 1392	1940	3dd5ff069f235670aaf809da16a34c8b_JaffaCakes118.exe	30
PID 1940 wrote to memory of 1392	1940	3dd5ff069f235670aaf809da16a34c8b_JaffaCakes118.exe	30
PID 1940 wrote to memory of 1392	1940	3dd5ff069f235670aaf809da16a34c8b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3dd5ff069f235670aaf809da16a34c8b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3dd5ff069f235670aaf809da16a34c8b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\9BC3.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\9BC3.tmp.exe" C:\Users\Admin\AppData\Local\Temp\3dd5ff069f235670aaf809da16a34c8b_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\9BC3.tmp.exe

Filesize
138KB

MD5
3dd5ff069f235670aaf809da16a34c8b

SHA1
2df5ce32a1b72dce3c80b241f0352c9f75293181

SHA256
9efd39afd7249817d5a8acf4885a8a4b4d7310e77bb9b56d00729eaba7f8e779

SHA512
d8984da717e9c3ced8a94d5ca2620927ba4d2068a73f1e2858753ab3fe461667035df548616e4f735f122ed416facb3e1e45a82a1ba983bfcc4103bd83b9c9fc

Download Submit
\Users\Admin\AppData\Local\Temp\9C4F.tmp

Filesize
102KB

MD5
1ab481b51688329c42637095149c6935

SHA1
649babc04bce3fa4241633f5082af5bba6014884

SHA256
0792b6fd68b6cd528cc9a77597254a0fcb36edbb204ad80e535c7da81326c09f

SHA512
70df3466d0105dca442c4762af0a89589236faa1d82133fa12e656024d8f4b6c8901ea96318e42a9085014acc0bb6263d9e08940a433dca0ea67fb4a3b939267

Download Submit
memory/1392-12-0x0000000002010000-0x0000000002120000-memory.dmp

Filesize
1.1MB

Download
memory/1392-23-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1392-18-0x0000000000530000-0x000000000054C000-memory.dmp

Filesize
112KB

Download
memory/1392-35-0x0000000002880000-0x0000000002A44000-memory.dmp

Filesize
1.8MB

Download
memory/1392-74-0x0000000000530000-0x000000000054C000-memory.dmp

Filesize
112KB

Download
memory/1392-70-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1392-69-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1392-68-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1392-67-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1392-57-0x0000000000530000-0x000000000054C000-memory.dmp

Filesize
112KB

Download
memory/1392-52-0x0000000002760000-0x0000000002800000-memory.dmp

Filesize
640KB

Download
memory/1392-47-0x00000000021A0000-0x00000000021E4000-memory.dmp

Filesize
272KB

Download
memory/1392-42-0x00000000020C0000-0x00000000020F5000-memory.dmp

Filesize
212KB

Download