dfb15afdde172526a07dfd381602435c80514b290296f306111436580a8e1794

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe
Size

24KB
MD5

679809d483b25922a1cab3332f29ce36
SHA1

caaa13590075ca60b2c828cf4df478f4bf170f4e
SHA256

dfb15afdde172526a07dfd381602435c80514b290296f306111436580a8e1794
SHA512

5ade1171dce6255db2567bbde4b64ddc1ad1a8914aa7765a665c64cbef7f9db55dcdf57a6b6810a5a833119905b512506c1fec0ecba92cb4b120965aeeafbe8e
SSDEEP

384:E3eVES+/xwGkRKJMcRlM61qmTTMVF9/q5u0:bGS+ZfbJMcRO8qYoAH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1944	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1988	ipconfig.exe
2756	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	tasklist.exe
Token: SeDebugPrivilege	2756	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2500	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe
2500	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2416	2500	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe	30
PID 2500 wrote to memory of 2416	2500	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe	30
PID 2500 wrote to memory of 2416	2500	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe	30
PID 2500 wrote to memory of 2416	2500	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2024	2416	cmd.exe	32
PID 2416 wrote to memory of 2024	2416	cmd.exe	32
PID 2416 wrote to memory of 2024	2416	cmd.exe	32
PID 2416 wrote to memory of 2024	2416	cmd.exe	32
PID 2416 wrote to memory of 1988	2416	cmd.exe	33
PID 2416 wrote to memory of 1988	2416	cmd.exe	33
PID 2416 wrote to memory of 1988	2416	cmd.exe	33
PID 2416 wrote to memory of 1988	2416	cmd.exe	33
PID 2416 wrote to memory of 1944	2416	cmd.exe	34
PID 2416 wrote to memory of 1944	2416	cmd.exe	34
PID 2416 wrote to memory of 1944	2416	cmd.exe	34
PID 2416 wrote to memory of 1944	2416	cmd.exe	34
PID 2416 wrote to memory of 2448	2416	cmd.exe	36
PID 2416 wrote to memory of 2448	2416	cmd.exe	36
PID 2416 wrote to memory of 2448	2416	cmd.exe	36
PID 2416 wrote to memory of 2448	2416	cmd.exe	36
PID 2448 wrote to memory of 1720	2448	net.exe	37
PID 2448 wrote to memory of 1720	2448	net.exe	37
PID 2448 wrote to memory of 1720	2448	net.exe	37
PID 2448 wrote to memory of 1720	2448	net.exe	37
PID 2416 wrote to memory of 2756	2416	cmd.exe	38
PID 2416 wrote to memory of 2756	2416	cmd.exe	38
PID 2416 wrote to memory of 2756	2416	cmd.exe	38
PID 2416 wrote to memory of 2756	2416	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1988
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:1720
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
69f4febffbd304f6835a4fbd338d92d7

SHA1
131d143ce5c9a2c9caedfd7d49cfbe760cd736c3

SHA256
5fe9bc4f9a8182f486590124f4bb962a6a4ca8d438ed4f0bcde33dd6e1ada194

SHA512
0dab6295f3c4389258021bcebc6f84253d2cf6c81e6913151a9b21a2afd9121c6e707578af7f8fd3bde0532d6253c8a49cad2abbe21f19ff5d343335f64d2f1e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads