9c166ed247328c61f53ec9a772a5025efa67825e75724d21781a4f1e48d20ae9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe
Size

118KB
MD5

5e0279ff7dcd5d6a14632763d87e950d
SHA1

f4d92c9e64afe1bab4daba35dfe2610388088a47
SHA256

9c166ed247328c61f53ec9a772a5025efa67825e75724d21781a4f1e48d20ae9
SHA512

af33e58094ac24580a8fbf3b7a9e3fa54587714637a3b4d9f90466bb98bedfbfad1d6e601876c797f87714b5b1ceccb86171a59d179ec2b4c51a98ecb8df717b
SSDEEP

1536:JJBmoOpffnxHpXnnw5FkUxWhkq0FfbZDeU3ubbO0FMXAKin:DBWpfvhpXGR6kq0FDZz3uO0Bn

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2756	svhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\$$config = "C:\\Windows\\svhost.exe"	5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\svhost.dll	5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe
File created	C:\Windows\svhost.exe	5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe
File opened for modification	C:\Windows\svhost.exe	5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2792	5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe
2756	svhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2756	2792	5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe	30
PID 2792 wrote to memory of 2756	2792	5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe	30
PID 2792 wrote to memory of 2756	2792	5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe	30
PID 2792 wrote to memory of 2756	2792	5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5e0279ff7dcd5d6a14632763d87e950d_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\svhost.exe
  C:\Windows\svhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\887001839.log

Filesize
6B

MD5
af0dc53c00d2f0f492a7892fef61c749

SHA1
37f27c8351f249cb8e3e9f2aeed01cf6e78bb78e

SHA256
0f0df3cfc1a7ec036ba411412b37add2ad71b1893f8e62475cca8ea37e0c9405

SHA512
50b298a74cde2ae0b78aa637be6c00b9c6f458e1b46c7f8dd1e810373c4823a289a1f925b1c890eee443a1bcd0b83c335c068f417c5c2c8431dedbea40d65b51

Download Submit
C:\Windows\svhost.exe

Filesize
118KB

MD5
5e0279ff7dcd5d6a14632763d87e950d

SHA1
f4d92c9e64afe1bab4daba35dfe2610388088a47

SHA256
9c166ed247328c61f53ec9a772a5025efa67825e75724d21781a4f1e48d20ae9

SHA512
af33e58094ac24580a8fbf3b7a9e3fa54587714637a3b4d9f90466bb98bedfbfad1d6e601876c797f87714b5b1ceccb86171a59d179ec2b4c51a98ecb8df717b

Download Submit
memory/2756-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2792-2-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2792-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2792-5-0x0000000000330000-0x0000000000344000-memory.dmp

Filesize
80KB

Download
memory/2792-20-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads