6ef29fb875f6def97af4f58a5568bb5646d4d4cbf96062ff6171889b1b93b36a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe
Size

11KB
MD5

61f528e1813298cc63d9461623fe3c78
SHA1

49740ebab6c3c39191daa5ebf2b2231ff4e0c625
SHA256

6ef29fb875f6def97af4f58a5568bb5646d4d4cbf96062ff6171889b1b93b36a
SHA512

a68e9cc4a9b9ee01226719dd69b08986b7b07f3105f4704e13aff7f77fcc5a0dbb181335eb17a24cdf53a6f74a451379f6d6c03b1a724033821ea6ffdc3b7d9e
SSDEEP

192:RYR+wsLmf9VfgnkYWCoIne80kotFfBnVPJ0YtjbBUdb1e65:e6irfgkYfX0t93B1tjbBUdbb

Score

8^/10

persistence privilege_escalation upx

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
60	caotxbk.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3428-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/files/0x00070000000234b2-4.dat	upx
behavioral2/memory/60-6-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3428-7-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/60-26-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\caotxbk.exe	61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\caotxb.dll	61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\caotxbk.exe	61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 60	3428	61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe	84
PID 3428 wrote to memory of 60	3428	61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe	84
PID 3428 wrote to memory of 60	3428	61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe	84
PID 3428 wrote to memory of 1032	3428	61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe	98
PID 3428 wrote to memory of 1032	3428	61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe	98
PID 3428 wrote to memory of 1032	3428	61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe	98

C:\Users\Admin\AppData\Local\Temp\61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\SysWOW64\caotxbk.exe
  C:\Windows\system32\caotxbk.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe.bat
  2⤵
  PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\61f528e1813298cc63d9461623fe3c78_JaffaCakes118.exe.bat

Filesize
210B

MD5
bc7c8c0e33511a2ed92558cf54e0f54b

SHA1
1bf742301532a069964f1e75e2cc5bdcdc6b56f3

SHA256
6d221b19b89d006ada7741a25148a7f68f1c047528c842bce93d16db2758a727

SHA512
efb86da0296a0b22349f7acde09f8106f9278365b3a8904b1f045e98f2ec974292285763087ac1d53decb7359858249a253d05762383e0af555cabc3a4df771c

Download Submit
C:\Windows\SysWOW64\caotxbk.exe

Filesize
11KB

MD5
61f528e1813298cc63d9461623fe3c78

SHA1
49740ebab6c3c39191daa5ebf2b2231ff4e0c625

SHA256
6ef29fb875f6def97af4f58a5568bb5646d4d4cbf96062ff6171889b1b93b36a

SHA512
a68e9cc4a9b9ee01226719dd69b08986b7b07f3105f4704e13aff7f77fcc5a0dbb181335eb17a24cdf53a6f74a451379f6d6c03b1a724033821ea6ffdc3b7d9e

Download Submit
memory/60-6-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/60-26-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3428-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3428-7-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download