cc8621e466bb18e25b1eb7f63fac0132483249a6ef4fedc56b8e14cec0f1842e

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 21:40

Target
71582d8546ea6ee53ee9ce8bfca380f4_JaffaCakes118.exe
Size 1.5MB
Sample240725-1jd8pswerj
SHA256 cc8621e466bb18e25b1eb7f63fac0132483249a6ef4fedc56b8e14cec0f1842e
MD5 71582d8546ea6ee53ee9ce8bfca380f4
SHA1 6b52f8677041db3ac07e0baa0271a2bd0476f2cb
SHA512 8afe0ce93d3cb3578f088534bb32c47290f1ab4f7d5fd1083dffffd7fdc6f0035ab821b7af88e246a59b6f15401cdd8b7ae586a858eb75f79eb9358fec937402
SSDEEP 24576:2/1d25dSdfHfiL8j0Ar3E3RBFShSuU0xMVS90hQMhbze0aeU1IWuu63zOFNQ7Yrm:IQCfWk3UnSnxMVSwaT1IPpOFNUYr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaUpdater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\71582d8546ea6ee53ee9ce8bfca380f4_JaffaCakes118.exe"	71582d8546ea6ee53ee9ce8bfca380f4_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71582d8546ea6ee53ee9ce8bfca380f4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
3588	reg.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 2036	3336	71582d8546ea6ee53ee9ce8bfca380f4_JaffaCakes118.exe	99
PID 3336 wrote to memory of 2036	3336	71582d8546ea6ee53ee9ce8bfca380f4_JaffaCakes118.exe	99
PID 3336 wrote to memory of 2036	3336	71582d8546ea6ee53ee9ce8bfca380f4_JaffaCakes118.exe	99
PID 2036 wrote to memory of 3588	2036	cmd.exe	101
PID 2036 wrote to memory of 3588	2036	cmd.exe	101
PID 2036 wrote to memory of 3588	2036	cmd.exe	101