0eab7a417611121c7d2ba7e3300f023938e51ec9203c965f38abe17272dfc29a

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 14:35

Target

5c5ad2a5bf127dd070d26ffbddd8f99c_JaffaCakes118.exe
Size

117KB
MD5

5c5ad2a5bf127dd070d26ffbddd8f99c
SHA1

0f5f3c87e84057723c559577333af11d1adc315f
SHA256

0eab7a417611121c7d2ba7e3300f023938e51ec9203c965f38abe17272dfc29a
SHA512

8a535502006fd5a1bacd3efcfeb8b41f8365da3e0b65fc254aa5172a4131d4c471c9322e04e6a1ee2c0617fdaf485c440459acbbe32a9c41be307d7eff9d1062
SSDEEP

768:8O8q/GDMdvqjNuVU1vcq9ahnLKCEUgkVG8X4zEGDAFGKj+:j8q/Ge2yUZc5htMn8X4IG8Y

Score

8^/10

persistence

Sets service image path in registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\767987E0\ImagePath = "C:\\Windows\\system32\\D30885E0.EXE -d"	5c5ad2a5bf127dd070d26ffbddd8f99c_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2348	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\D30885E0.EXE	5c5ad2a5bf127dd070d26ffbddd8f99c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2540	5c5ad2a5bf127dd070d26ffbddd8f99c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2540	5c5ad2a5bf127dd070d26ffbddd8f99c_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	5c5ad2a5bf127dd070d26ffbddd8f99c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2348	2540	5c5ad2a5bf127dd070d26ffbddd8f99c_JaffaCakes118.exe	31
PID 2540 wrote to memory of 2348	2540	5c5ad2a5bf127dd070d26ffbddd8f99c_JaffaCakes118.exe	31
PID 2540 wrote to memory of 2348	2540	5c5ad2a5bf127dd070d26ffbddd8f99c_JaffaCakes118.exe	31
PID 2540 wrote to memory of 2348	2540	5c5ad2a5bf127dd070d26ffbddd8f99c_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\5c5ad2a5bf127dd070d26ffbddd8f99c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c5ad2a5bf127dd070d26ffbddd8f99c_JaffaCakes118.exe"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\5C5AD2~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2348