50dc490f0dd9466fc8733bb6934f73305e3200a75a857d6c660c662ea8d17070

Analysis

max time kernel
149s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
Size

115KB
MD5

8319605f9c49e058a7eca47f65848c47
SHA1

5405b8e180f91bb13504b753fbd4bae883eb66b3
SHA256

50dc490f0dd9466fc8733bb6934f73305e3200a75a857d6c660c662ea8d17070
SHA512

8438c3172e50570eec7c6171fcf835c089f0a3ec265077e0ceaa11af374803130a2aeb908b11fe203a42a4d1a5bca19e9be731cadcf92cf2332e2e2c0f7cdeb6
SSDEEP

3072:1V1DcfFQ2/osc7RhCjPqLQVtTZMcesfOoNSflxAxJHlDoe:1VqloscdhCzq0Vcl6OaSflxCJFUe

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iwgxg.exe = "\"C:\\Windows\\iwgxg.exe\""	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\iwgxg.exe = "\"C:\\Windows\\iwgxg.exe\""	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\iwgxg.exe	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
File opened for modification	C:\Windows\iwgxg.exe	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Privacy	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
Token: SeSecurityPrivilege	780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
Token: SeSecurityPrivilege	780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
Token: SeSecurityPrivilege	780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
Token: SeDebugPrivilege	780	8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8319605f9c49e058a7eca47f65848c47_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\EBB22CB7BBB66D.dat

Filesize
561B

MD5
c7a0429815db42cab07d4d6df8de0122

SHA1
8b7add3abf21e21d3fb1b6148aa3a0f69589fdf5

SHA256
64763bfb0a7e87656019a673079174b63251431256b22c4343201cf5871a546b

SHA512
13232578a1603c52a4f97667c2a0f54694f648b0849f388d10d223af902065a150797f6816bf6271812030e43aeeb646868d63343c1b8a4a3a2840e76a631922

Download Submit
C:\Windows\iwgxg.exe

Filesize
115KB

MD5
8319605f9c49e058a7eca47f65848c47

SHA1
5405b8e180f91bb13504b753fbd4bae883eb66b3

SHA256
50dc490f0dd9466fc8733bb6934f73305e3200a75a857d6c660c662ea8d17070

SHA512
8438c3172e50570eec7c6171fcf835c089f0a3ec265077e0ceaa11af374803130a2aeb908b11fe203a42a4d1a5bca19e9be731cadcf92cf2332e2e2c0f7cdeb6

Download Submit
memory/780-56-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-142-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-9-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-14-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-25-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/780-38-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/780-42-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-44-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-46-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-163-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-6-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-78-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-74-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-65-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-87-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-95-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-104-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-116-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-125-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-133-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-57-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-154-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/780-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download