830e6033803878728f056dc050956c53f9c9473aff2dc618d887a285484fbb2a

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
Size

31KB
MD5

454df5dff92aa7f01e928af0e70b2cc0
SHA1

11fb445d3cc5dda4c8cc019162635caf6402fece
SHA256

830e6033803878728f056dc050956c53f9c9473aff2dc618d887a285484fbb2a
SHA512

5b24be1e26a49d3f0217f51f93422158f48254868d53ff3209b2d7d77dbf97300dfee8d1250a45ed435accf109858c8e1e9ad2f2073fe49199196729f2aea594
SSDEEP

768:UoneDDDFvT2RDFmjGU8zHTHXzXHCzcsHizTxavc:UonUvaRDkjGU4j5j0vc

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Admin.exe

Executes dropped EXE 1 IoCs

pid	Process
1500	Admin.exe

Loads dropped DLL 2 IoCs

pid	Process
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe"	Admin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe"	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
1500	Admin.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
1500	Admin.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1500	2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe	30
PID 2400 wrote to memory of 1500	2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe	30
PID 2400 wrote to memory of 1500	2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe	30
PID 2400 wrote to memory of 1500	2400	454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\454df5dff92aa7f01e928af0e70b2cc0_JaffaCakes118.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\Admin.exe
  "C:\Users\Admin\Admin.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\Admin.exe

Filesize
31KB

MD5
0463cdba960f928bf5349eeb42b9da79

SHA1
9a0e16e1c60736f9996027f1daa7eed11fb12d85

SHA256
f56fe6ed498bd30e61d5a8862dc801620d5d4fc2a9aa685a9fc6aa103b8be217

SHA512
df5fbe7f34f4465a39c001eef6fcde80dcae0cfe20f9a6f464b27413cb5c6a17e153c322a8e61818ad6def1d08ed73ebe128d10ed73af418f993504ef26a4399

Download Submit
memory/1500-13-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2400-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download