dfb15afdde172526a07dfd381602435c80514b290296f306111436580a8e1794

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe
Size

24KB
MD5

679809d483b25922a1cab3332f29ce36
SHA1

caaa13590075ca60b2c828cf4df478f4bf170f4e
SHA256

dfb15afdde172526a07dfd381602435c80514b290296f306111436580a8e1794
SHA512

5ade1171dce6255db2567bbde4b64ddc1ad1a8914aa7765a665c64cbef7f9db55dcdf57a6b6810a5a833119905b512506c1fec0ecba92cb4b120965aeeafbe8e
SSDEEP

384:E3eVES+/xwGkRKJMcRlM61qmTTMVF9/q5u0:bGS+ZfbJMcRO8qYoAH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2312	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4956	ipconfig.exe
1188	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	tasklist.exe
Token: SeDebugPrivilege	1188	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2444	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe
2444	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2380	2444	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe	83
PID 2444 wrote to memory of 2380	2444	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe	83
PID 2444 wrote to memory of 2380	2444	679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe	83
PID 2380 wrote to memory of 388	2380	cmd.exe	85
PID 2380 wrote to memory of 388	2380	cmd.exe	85
PID 2380 wrote to memory of 388	2380	cmd.exe	85
PID 2380 wrote to memory of 4956	2380	cmd.exe	86
PID 2380 wrote to memory of 4956	2380	cmd.exe	86
PID 2380 wrote to memory of 4956	2380	cmd.exe	86
PID 2380 wrote to memory of 2312	2380	cmd.exe	87
PID 2380 wrote to memory of 2312	2380	cmd.exe	87
PID 2380 wrote to memory of 2312	2380	cmd.exe	87
PID 2380 wrote to memory of 1320	2380	cmd.exe	89
PID 2380 wrote to memory of 1320	2380	cmd.exe	89
PID 2380 wrote to memory of 1320	2380	cmd.exe	89
PID 1320 wrote to memory of 1248	1320	net.exe	90
PID 1320 wrote to memory of 1248	1320	net.exe	90
PID 1320 wrote to memory of 1248	1320	net.exe	90
PID 2380 wrote to memory of 1188	2380	cmd.exe	92
PID 2380 wrote to memory of 1188	2380	cmd.exe	92
PID 2380 wrote to memory of 1188	2380	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\679809d483b25922a1cab3332f29ce36_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:388
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4956
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2312
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:1248
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
14KB

MD5
ab8efc41e8778a04ee94e55dc70f1ad2

SHA1
2f2cbabd5fef7ebfbeea029c478a7f7b072bfd4a

SHA256
966edc80cd05d540f2670df15f121a35bf73578ca2c94a5f0384c9253ee29796

SHA512
85fb95a2b54318cba3d694f64e492df239be62a3ecbc2307c0e13973f139292cc62b12d9c95ec45e33ae7aa34e5a3f73b2bbe0c27bcdd96bb92c078a8f2ea32c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads