76f62fb486d1ae2ae446d1b7867b258b9df28f1d69258b092c09ff0b928a3a26

Analysis

max time kernel
90s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe
Size

1.1MB
MD5

41dd6c1cbb03b3c8535a95a92cb93bf2
SHA1

bf6489148dfabf487feea89b7f3c7ffe08cc29bf
SHA256

76f62fb486d1ae2ae446d1b7867b258b9df28f1d69258b092c09ff0b928a3a26
SHA512

a21a684663f49014c68e1888102b2b1204286f9c4e16f9f0d1c8bcd745a160f7cc2a2bc97c9924103ab91669297fb2f9ed9913f187bfeffd93cee8c02889e533
SSDEEP

12288:6IGlf+clolWVs59F8l6hobM0sZYT3euGLH5Ws7QvYwjrh0gaGqyvwf2bHzU:N6+98l6CbM01TwW6ZwLqjuI

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\KLSet.ini	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\KLSet.ini	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe
File created	C:\WINDOWS\regadit.ini	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe
3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe
3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe
3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe
3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe
3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 684	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	87
PID 3216 wrote to memory of 684	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	87
PID 3216 wrote to memory of 684	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	87
PID 3216 wrote to memory of 3992	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	88
PID 3216 wrote to memory of 3992	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	88
PID 3216 wrote to memory of 3992	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	88
PID 3216 wrote to memory of 4500	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	89
PID 3216 wrote to memory of 4500	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	89
PID 3216 wrote to memory of 4500	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	89
PID 3216 wrote to memory of 3804	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	90
PID 3216 wrote to memory of 3804	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	90
PID 3216 wrote to memory of 3804	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	90
PID 3216 wrote to memory of 3068	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	91
PID 3216 wrote to memory of 3068	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	91
PID 3216 wrote to memory of 3068	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	91
PID 3216 wrote to memory of 1516	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	92
PID 3216 wrote to memory of 1516	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	92
PID 3216 wrote to memory of 1516	3216	41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\41dd6c1cbb03b3c8535a95a92cb93bf2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s D:\banlv\MSFLXGRD.OCX
  2⤵
  PID:684
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s D:\banlv\TABCTL32.OCX
  2⤵
  PID:3992
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s C:\WINDOWS\system32\TABCTL32.OCX
  2⤵
  PID:4500
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s C:\WINDOWS\system32\MSFLXGRD.OCX
  2⤵
  PID:3804
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s D:\banlv\TABCTL32.OCX
  2⤵
  PID:3068
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s D:\banlv\MSFLXGRD.OCX
  2⤵
  PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3216-0-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3216-1-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3216-12-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download