24ee37fb2460905df559ef4c7fc2676a2e243838acc28fcc1a6e95ec274e44b1

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe
Size

14KB
MD5

5a889e58c5e43d6b15ac6acf3e4a30bd
SHA1

3d847e708dfe84855c0df9bc51552296b0449d11
SHA256

24ee37fb2460905df559ef4c7fc2676a2e243838acc28fcc1a6e95ec274e44b1
SHA512

31819e3be9dbd6027d203c434866a574e962a1316e8b9917d5fad8c067256925dff2daa2562dc1dcf211458c30c1d62697909c5913c21fcf024701b0538a9a8a
SSDEEP

384:Ptz0kHexAx7/X0K9FHZqYPGCAy2O7PZELKL+sY:PK2tx7UlCAypGXf

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ksuserfy.dll = "{00130013-0013-0013-0013-00130013BB15}"	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1480	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ksuserfy.tmp	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ksuserfy.tmp	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ksuserfy.nls	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00130013-0013-0013-0013-00130013BB15}\InProcServer32	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00130013-0013-0013-0013-00130013BB15}\InProcServer32\ = "C:\\Windows\\SysWow64\\ksuserfy.dll"	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00130013-0013-0013-0013-00130013BB15}\InProcServer32\ThreadingModel = "Apartment"	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00130013-0013-0013-0013-00130013BB15}	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1480	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe
1480	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1480	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1116	1480	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe	95
PID 1480 wrote to memory of 1116	1480	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe	95
PID 1480 wrote to memory of 1116	1480	5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5a889e58c5e43d6b15ac6acf3e4a30bd_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FEE2.tmp.bat
  2⤵
  PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FEE2.tmp.bat

Filesize
207B

MD5
005178f59061c594740b274b9b106dcf

SHA1
3625fbca5dcaf3c8c22be7d5a884445df5a917d1

SHA256
da79e4327db499ecd97505636fce5398abf0240bd0bd24586dbfd301b470bdab

SHA512
33256567737342c3c8d18f1dd7b1e6dc299eeab7f4a6e50edeb1f189d1a32dbb38e9a28e543e1288c99efce5c666b5c7c722133844c6f1385fb035a9528d79a0

Download Submit
C:\Windows\SysWOW64\ksuserfy.tmp

Filesize
890KB

MD5
9bada95738a2a629857954730009c987

SHA1
299645264bc067ba4c5747041f410e9c2803cc73

SHA256
4224a38ef95513ffa6224493d16baef532a4c79808796c3aac9f7033a7b6726f

SHA512
a887938a7c3971450fb91a057a5ff9da456b4dd172aad7a76c2f1525f2abf074f9facaa497f5c7738f710a7ddf7175ddfdede5aabf919cbb0eeae187d6db2f03

Download Submit