1c224ce4992ecca7cdcfbacc825677335bb73a397c4451c2ac8c888b14140bed

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe
Size

12KB
MD5

46b494521dd35d426e32a5bd21864e53
SHA1

4718fe51fd0fcd257379c03aa56650e624c3a0af
SHA256

1c224ce4992ecca7cdcfbacc825677335bb73a397c4451c2ac8c888b14140bed
SHA512

ea9ac0c4f6af1bd6411f1aa7781a2bcafca3f6674889b280610e15ab80a26a977189bd16834fc8ce6785a6fdace36eab4889ff1ec2f46fdfb0c06608c37900af
SSDEEP

192:UoQI2DE9EJ5g2GXWzX6qexxZceKPl4iT4jMBi6Ktq0zcMideTHkEtJ2LzP:Uov9Es2qWzXgxxZ6PCm4jMi1qNut+LD

Score

8^/10

persistence privilege_escalation upx

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4072	rexljehk.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4456-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/files/0x00090000000234b1-4.dat	upx
behavioral2/memory/4456-6-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4072-7-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rexljeh.dll	46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rexljehk.exe	46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rexljehk.exe	46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4072	4456	46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe	85
PID 4456 wrote to memory of 4072	4456	46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe	85
PID 4456 wrote to memory of 4072	4456	46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe	85
PID 4456 wrote to memory of 656	4456	46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe	89
PID 4456 wrote to memory of 656	4456	46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe	89
PID 4456 wrote to memory of 656	4456	46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\rexljehk.exe
  C:\Windows\system32\rexljehk.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe.bat
  2⤵
  PID:656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\46b494521dd35d426e32a5bd21864e53_JaffaCakes118.exe.bat

Filesize
210B

MD5
5b6be6889fb9db79c6688305ddcd21b5

SHA1
7475eb9063b913cd5d4b7981d329d62988fc0c4c

SHA256
691e839c7ea8ad21397808fe6d6503cbbd5e2787554af11b4205b6ffce8e54c0

SHA512
bf72b5655e21357d0c94e75c6c63fa5528953c1e38032826620e31ee9daa1fc67250c86c2ab7799abdb2b73fc2677450f2ec9fcd60072af7b7c668c33c7f4e45

Download Submit
C:\Windows\SysWOW64\rexljehk.exe

Filesize
12KB

MD5
46b494521dd35d426e32a5bd21864e53

SHA1
4718fe51fd0fcd257379c03aa56650e624c3a0af

SHA256
1c224ce4992ecca7cdcfbacc825677335bb73a397c4451c2ac8c888b14140bed

SHA512
ea9ac0c4f6af1bd6411f1aa7781a2bcafca3f6674889b280610e15ab80a26a977189bd16834fc8ce6785a6fdace36eab4889ff1ec2f46fdfb0c06608c37900af

Download Submit
memory/4072-7-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4456-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4456-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download