78a91989874bf24dd0932fb6bf933878aced6e74afc98a4986b12219e07cde79

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 23:35

Target

6542b3cef1eb741f1d80cfa564745a63_JaffaCakes118.exe
Size

117KB
MD5

6542b3cef1eb741f1d80cfa564745a63
SHA1

8de23bf1e1a20fdf0bed9c1ff301b4d8a11e52de
SHA256

78a91989874bf24dd0932fb6bf933878aced6e74afc98a4986b12219e07cde79
SHA512

29651f3858aa9e8b33c57a7bc9d306f3e8dd3a43670d35ae110913406bc34f5a63f37e65d1f7322b55db34e3fdfe5d55ec0c01723a48c73e887c0d0a77d4c3a7
SSDEEP

768:8O8q/GDMdvqjNuVU1vcq9ahnLKCEUgkVG8X4zEGDAFGKj0:j8q/Ge2yUZc5htMn8X4IG8+

Score

8^/10

persistence

Sets service image path in registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\D1FBFBC6\ImagePath = "C:\\Windows\\system32\\B0323B13.EXE -d"	6542b3cef1eb741f1d80cfa564745a63_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2940	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\B0323B13.EXE	6542b3cef1eb741f1d80cfa564745a63_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2180	6542b3cef1eb741f1d80cfa564745a63_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2180	6542b3cef1eb741f1d80cfa564745a63_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	6542b3cef1eb741f1d80cfa564745a63_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2940	2180	6542b3cef1eb741f1d80cfa564745a63_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2940	2180	6542b3cef1eb741f1d80cfa564745a63_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2940	2180	6542b3cef1eb741f1d80cfa564745a63_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2940	2180	6542b3cef1eb741f1d80cfa564745a63_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\6542b3cef1eb741f1d80cfa564745a63_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6542b3cef1eb741f1d80cfa564745a63_JaffaCakes118.exe"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\6542B3~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2940