90b5e6848ff51beeeb8d3a2696ecdebcb5958706aa9eaf9f07ea9a359e9a2ac8

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 09:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe
Size

1.1MB
MD5

5ff0e7972f8d63fa0e2cab777452c4fb
SHA1

eec1f306ad702a060e1e6cca3f687a0b88e8c1aa
SHA256

90b5e6848ff51beeeb8d3a2696ecdebcb5958706aa9eaf9f07ea9a359e9a2ac8
SHA512

bb559ec4007bc6846909abf06432cefb751b630063cc8307df569aa0cbfbc08733d90b5af3cf508b90697fb84e9d6443fb829b4101f5e9cd818cb6ca69398413
SSDEEP

12288:fhWPEQK6RSA09twTBlWr+3tyNCDaDwJOkamX90PVASzgK75HkP2cswZOSHTLA:fhWPEL6gA09tw6K97imeGSUbP2HwZO2A

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\360antiarp = "\\Users\\Admin\\AppData\\Local\\Temp\\5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe"	reg.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\run.cmd	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe
2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe
2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe
2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe
2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe
2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe
2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe
2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe
2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe
2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2356	2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe	30
PID 2944 wrote to memory of 2356	2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe	30
PID 2944 wrote to memory of 2356	2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe	30
PID 2944 wrote to memory of 2356	2944	5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe	30
PID 2356 wrote to memory of 2552	2356	cmd.exe	32
PID 2356 wrote to memory of 2552	2356	cmd.exe	32
PID 2356 wrote to memory of 2552	2356	cmd.exe	32
PID 2356 wrote to memory of 2552	2356	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\windows\system32\run.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v 360antiarp /t REG_SZ /d "\Users\Admin\AppData\Local\Temp\5ff0e7972f8d63fa0e2cab777452c4fb_JaffaCakes118.exe" /f
    3⤵
    - Adds Run key to start application
    PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\run.cmd

Filesize
216B

MD5
a8294e9d9aa7d91cc6410d0b9ef9ad08

SHA1
16e9228b45f2a7d522e0581edb0c4ffde1a6d04d

SHA256
d9b2734ff52d3922d32ae3fe6a76228d6a5a1aaeea2ec8d13e9cf27b5d1cf08c

SHA512
d4c7a335ce0da3db7cb2db37801f2558c6e8918f777481028dfa65db393d287e6f39ff4e0b3215003b4636ec28cf5c318485aa92e01a979d088fc51761b7cbf2

Download Submit
\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

Filesize
1.1MB

MD5
638e737b2293cf7b1f14c0b4fb1f3289

SHA1
f8e2223348433b992a8c42c4a7a9fb4b5c1158bc

SHA256
baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b

SHA512
4d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12

Download Submit
memory/2944-1-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2944-12-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads