453125b7d77c613c8c877985271b4a522ade1948beab2ab52ab399b54c1ce4f1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5efd138c4452e0c651d98474e30c285a_JaffaCakes118.exe
Size

683KB
MD5

5efd138c4452e0c651d98474e30c285a
SHA1

190907db842187d876ce2ae6bf9820b32c172a0f
SHA256

453125b7d77c613c8c877985271b4a522ade1948beab2ab52ab399b54c1ce4f1
SHA512

eee39f4bfb941db0cc86193e5680af498f32479ab58075367b2a71bbe139223eb35ac9e27e84522832cc0d8531ec10f96b315c991b13327c2ec924beeaccb238
SSDEEP

12288:VRUGcCOeZZpddkotInBQZww5Wbjr1c2obY7PXl8Bhu7sE8:VRUXCOehhuBOXgfbocJ8Bg7O

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2056	a.exe

Loads dropped DLL 3 IoCs

pid	Process
2176	5efd138c4452e0c651d98474e30c285a_JaffaCakes118.exe
2176	5efd138c4452e0c651d98474e30c285a_JaffaCakes118.exe
2056	a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5efd138c4452e0c651d98474e30c285a_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SVKP.sys	a.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2056	2176	5efd138c4452e0c651d98474e30c285a_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2056	2176	5efd138c4452e0c651d98474e30c285a_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2056	2176	5efd138c4452e0c651d98474e30c285a_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2056	2176	5efd138c4452e0c651d98474e30c285a_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2056	2176	5efd138c4452e0c651d98474e30c285a_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2056	2176	5efd138c4452e0c651d98474e30c285a_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2056	2176	5efd138c4452e0c651d98474e30c285a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5efd138c4452e0c651d98474e30c285a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5efd138c4452e0c651d98474e30c285a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\a.exe

Filesize
399KB

MD5
1f89ce5b6c1734cebcda5ac96bfb20d1

SHA1
0c105c52767e43e371c70b35785eb2526a423fb7

SHA256
52027a70ffcb254f5e914bb7ffb82ed0fb532b9c2f63eb05303fef089df0bd34

SHA512
b9ed2508f740d171e7710afea8493e167de1fd8d97676a2f98b5f864efc06794f71e35aa89af9754accc3e9992a21862b100466bb4ec9fbe2416bfd1043f3e7b

Download Submit
memory/2056-17-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2176-0-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download
memory/2176-1-0x00000000002B0000-0x0000000000367000-memory.dmp

Filesize
732KB

Download
memory/2176-3-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download
memory/2176-2-0x0000000001071000-0x0000000001072000-memory.dmp

Filesize
4KB

Download
memory/2176-6-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download
memory/2176-19-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads