c3005294d4fa3fd59ee4492607e39076ff8e455e23dc6391277feb34b185978b

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3f9eb923df0704d8b0020383f194ad7c_JaffaCakes118.exe
Size 2.3MB
Sample240713-bmlphsyhmm
SHA256 c3005294d4fa3fd59ee4492607e39076ff8e455e23dc6391277feb34b185978b
MD5 3f9eb923df0704d8b0020383f194ad7c
SHA1 1524c28a726dd90f6416cc3ab306fe4d0fee7cbb
SHA512 6b71dfdbd2eaf05fda8dbe60b81c8a4ff6218b30dfcbd3bc2245faa3adafaf21e7104802f235acc417ec555d38fdb78571feab7067532ccc1eccdf904cd7fe96
SSDEEP 49152:5Fu7U7pIv0BoUoXBj5jracNibLHkJkgZv:io7av0BoPj52DkJ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2348	svchost.exe
1384	setup.exe

Loads dropped DLL 7 IoCs

pid	Process
2348	svchost.exe
2348	svchost.exe
2348	svchost.exe
2348	svchost.exe
2348	svchost.exe
2348	svchost.exe
2348	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cftmon.exe = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Web Components\\cftmon.exe"	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\cftmon.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000a000000023401-4.dat	nsis_installer_1
behavioral2/files/0x000a000000023401-4.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2348	2124	3f9eb923df0704d8b0020383f194ad7c_JaffaCakes118.exe	84
PID 2124 wrote to memory of 2348	2124	3f9eb923df0704d8b0020383f194ad7c_JaffaCakes118.exe	84
PID 2124 wrote to memory of 2348	2124	3f9eb923df0704d8b0020383f194ad7c_JaffaCakes118.exe	84
PID 2124 wrote to memory of 1384	2124	3f9eb923df0704d8b0020383f194ad7c_JaffaCakes118.exe	85
PID 2124 wrote to memory of 1384	2124	3f9eb923df0704d8b0020383f194ad7c_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\3f9eb923df0704d8b0020383f194ad7c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f9eb923df0704d8b0020383f194ad7c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  PID:2348
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  C:\Users\Admin\AppData\Local\Temp\setup.exe
  2⤵
  - Executes dropped EXE
  PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NSISArray.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi8E85.tmp\NSISArray.dll
Size 19KB
SHA256 6a129a9eefae85a9412e889e0c74fdaa21d20254fa13cacef5429885775017dc
MD5 14b848866035dea39b912da628307231
SHA1 d00c8963aee8038d8a22f098cef69b31007196e5
SHA512 4538058426c742bf7d823d1cac5303eeff8bf0b524459262181ac79695eead705e7590ae63ce996b8e3afd9a6c8d1fec503f9a11772ebe5c5c4e01930ed97b16
SSDEEP 384:J+o6oNJDOD4mqjCQ2UcW3++Mnnm8GPHltUIH4qpjiX:gDoNJyD4mqjCOsnmtHltUIYqFi
MD5 SHA1 SHA512 SSDEEP

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi8E85.tmp\inetc.dll
Size 24KB
SHA256 983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341
MD5 1efbbf5a54eb145a1a422046fd8dfb2c
SHA1 ec4efd0a95bb72fd4cf47423647e33e5a3fddf26
SHA512 7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb
SSDEEP 384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\setup.exe
Size 1.3MB
SHA256 1c2d82d5c78cf8ca293d174c540eac003bca79be52d34f2404cfc4ac4879c42e
MD5 822c753f5b8737072d30ad468e15d436
SHA1 1186d8957c2d1d68f711d398d431a13289935dba
SHA512 7e38acaaf47c8f672a31732070c2941dd3c17e6da74998bbf7d118244f75cc2f1dbbae52862cd33173e9c4f8e438fc3e056c3e4f1eade03caf865054b40897f9
SSDEEP 24576:NXnD5tfLR57jXacNi9JLHgZJJkDofjZSS1:tjracNibLHkJkgZv
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 633KB
SHA256 a467d6f91034d1936d550745a4514344115341e3c9b1228ebe17cdaec24f7172
MD5 a10354f476aa8c50b96d55d9e8d2bb0d
SHA1 4490f75e0b3b0653896a1ee4add263485f20fc22
SHA512 2a99dc95c2bf58ade2157d2bf49d9b2b7152224df6637e3f2ec169510791b5bff2691eecad3e5f6d9593daa7633e118dc609e44f72fd1ac4192215ef6465657c
SSDEEP 12288:OmMD2tn5CCppD2tnN40OyuE3iPlkwdisMVUoX27aqu1VSX4ZdjnpKS:Om/tn5bpItnNH0BoUoXY4Djpd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2124-38-0x0000000000400000-0x000000000048D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads