e013e923f9c4156e2a945a12a064b975f0d363237fb1414cfa0040b5c36f5d13

Analysis

max time kernel
124s
max time network
126s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78c4d3e9d1399b4ec24577c91f1fa27d_JaffaCakes118.exe
Size

33KB
MD5

78c4d3e9d1399b4ec24577c91f1fa27d
SHA1

da165a36d401325562ce46f91ac5e88ef5d46336
SHA256

e013e923f9c4156e2a945a12a064b975f0d363237fb1414cfa0040b5c36f5d13
SHA512

cad7924dec39f0147a1e9e3f9f18935ce54b54a85f6218f3c8544eae45ad300f9c2874b795d82aa3983431f1993a597dd738020fd37d5f9b100a08dc5e4d41a5
SSDEEP

768:RktmtIHEe8IDPIXRnRn3psupMG6uJXPYB:utmGHx8AIX/npMGZA

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
bl00dl1n3

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1388	iexplorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\iexplorer.exe"	iexplorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	iexplorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1388	iexplorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1388	2064	78c4d3e9d1399b4ec24577c91f1fa27d_JaffaCakes118.exe	30
PID 2064 wrote to memory of 1388	2064	78c4d3e9d1399b4ec24577c91f1fa27d_JaffaCakes118.exe	30
PID 2064 wrote to memory of 1388	2064	78c4d3e9d1399b4ec24577c91f1fa27d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\78c4d3e9d1399b4ec24577c91f1fa27d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\78c4d3e9d1399b4ec24577c91f1fa27d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Roaming\iexplorer.exe
  "C:\Users\Admin\AppData\Roaming\iexplorer.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\iexplorer.exe

Filesize
33KB

MD5
78c4d3e9d1399b4ec24577c91f1fa27d

SHA1
da165a36d401325562ce46f91ac5e88ef5d46336

SHA256
e013e923f9c4156e2a945a12a064b975f0d363237fb1414cfa0040b5c36f5d13

SHA512
cad7924dec39f0147a1e9e3f9f18935ce54b54a85f6218f3c8544eae45ad300f9c2874b795d82aa3983431f1993a597dd738020fd37d5f9b100a08dc5e4d41a5

Download Submit
memory/1388-9-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/1388-10-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2064-0-0x000007FEF53BE000-0x000007FEF53BF000-memory.dmp

Filesize
4KB

Download
memory/2064-8-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads