e0930249ff22d1d2b877706d45e37c4acad8d909a0c13dee0abffc7e29b087e4

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

620d97d0915828dd5a5275b56d5c79a9_JaffaCakes118.exe
Size

7.3MB
MD5

620d97d0915828dd5a5275b56d5c79a9
SHA1

c5289dfe031496b9b8aab04267b77846079615d2
SHA256

e0930249ff22d1d2b877706d45e37c4acad8d909a0c13dee0abffc7e29b087e4
SHA512

4ec1adf4022bf3af462890ce0c6b19212d0b367dfa3fade89cded7b2edec9661d18b97b9e3b89166b32a4a57ad8020af8ccb12400c3df2455d9913f63988c934
SSDEEP

98304:pMi6zWl+KNjJsP1WUrhaO96atQzj3wXLx7skk8EyBI54Yo1T:pF6ze+KNiX8O96atW2Lx7skk8M4z

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Run','C:\Arquivos de programas\tmpnews.exe = "C:\\Arquivos de programas\\tmpnews.exe"	620d97d0915828dd5a5275b56d5c79a9_JaffaCakes118.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2376	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2348	620d97d0915828dd5a5275b56d5c79a9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2376	2348	620d97d0915828dd5a5275b56d5c79a9_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2376	2348	620d97d0915828dd5a5275b56d5c79a9_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2376	2348	620d97d0915828dd5a5275b56d5c79a9_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2376	2348	620d97d0915828dd5a5275b56d5c79a9_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\620d97d0915828dd5a5275b56d5c79a9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\620d97d0915828dd5a5275b56d5c79a9_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn balada /tr c:\autoexec.bat /sc onstart /ru system
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2348-2-0x0000000000400000-0x0000000000B5B000-memory.dmp

Filesize
7.4MB

Download
memory/2348-4-0x0000000000400000-0x0000000000B5B000-memory.dmp

Filesize
7.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads