41754660e199e9027afaf46edf0de3f8be91a19536a27ad4cd08c41f5f213793

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e01e390bbbe011cd06b71fc01e69f43_JaffaCakes118.exe
Size

228KB
MD5

8e01e390bbbe011cd06b71fc01e69f43
SHA1

e03d89323424cc9df1e4b872b6002a978438fb4f
SHA256

41754660e199e9027afaf46edf0de3f8be91a19536a27ad4cd08c41f5f213793
SHA512

37a903167c2881a105360930a0ffe30eefc559e0ee7caa6c448467da569e400218f024ec0143f8dac28a1d546732f7a3a3462d59d77e3a92d78b219247e6435e
SSDEEP

6144:EaKMSD4Yuaebp0yN90QEWwy9weGYfjZXKL:NK3D4laby90IHvf9

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
888	Axx.exe
1716	SHELLC~1.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8e01e390bbbe011cd06b71fc01e69f43_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 888	2476	8e01e390bbbe011cd06b71fc01e69f43_JaffaCakes118.exe	30
PID 2476 wrote to memory of 888	2476	8e01e390bbbe011cd06b71fc01e69f43_JaffaCakes118.exe	30
PID 2476 wrote to memory of 888	2476	8e01e390bbbe011cd06b71fc01e69f43_JaffaCakes118.exe	30
PID 2476 wrote to memory of 1716	2476	8e01e390bbbe011cd06b71fc01e69f43_JaffaCakes118.exe	31
PID 2476 wrote to memory of 1716	2476	8e01e390bbbe011cd06b71fc01e69f43_JaffaCakes118.exe	31
PID 2476 wrote to memory of 1716	2476	8e01e390bbbe011cd06b71fc01e69f43_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\8e01e390bbbe011cd06b71fc01e69f43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8e01e390bbbe011cd06b71fc01e69f43_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Axx.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Axx.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SHELLC~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SHELLC~1.EXE
  2⤵
  - Executes dropped EXE
  PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Axx.exe

Filesize
118KB

MD5
e1f2bca7f29657040b704bffa82acbd7

SHA1
55b54726d8c90d84df4fcf31ff98f8f54e56e0e9

SHA256
b110101e22bcc7c99a12d43eddc0c9ce1d2a9cab34983357e24be5ed533faf38

SHA512
81fa0c066899822ffdf653eff6c48490e6d31dc57499330f91769b04d63deb319b0b00f6206775028b861ce8a41c60db97fa50b08812148794c1862c7edf7a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SHELLC~1.EXE

Filesize
73KB

MD5
d4cebee2f869085c58eeda594876351f

SHA1
e3d08c1370f45d0f1061efb625106abd49c411a9

SHA256
9323cbeb55696ea6ca5451eba08b6e37ed5da4a065a7f98aa75dc4dc21f47f44

SHA512
333dd2e1cacdae9f33b89df0f0c174df6e5c1b92cf1a1d778c07ddcaebb703dc34186f4707f8e127be31e0e3ed0c020ce0da0a4dcbe06ff5a75dc28dae3fc5af

Download Submit
memory/888-7-0x000007FEF606E000-0x000007FEF606F000-memory.dmp

Filesize
4KB

Download
memory/888-8-0x000007FEF5DB0000-0x000007FEF674D000-memory.dmp

Filesize
9.6MB

Download
memory/888-9-0x000007FEF5DB0000-0x000007FEF674D000-memory.dmp

Filesize
9.6MB

Download
memory/888-10-0x000007FEF5DB0000-0x000007FEF674D000-memory.dmp

Filesize
9.6MB

Download
memory/888-11-0x000007FEF5DB0000-0x000007FEF674D000-memory.dmp

Filesize
9.6MB

Download
memory/1716-17-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

Filesize
9.6MB

Download
memory/1716-16-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

Filesize
9.6MB

Download
memory/1716-15-0x000007FEF56CE000-0x000007FEF56CF000-memory.dmp

Filesize
4KB

Download
memory/1716-18-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads