ad646fd863ac36bba5a7b404d9e19a23a45300b8c881434ec118f658961abb3a

Analysis

max time kernel
141s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf25180b8ed06fe66cf08f4fbe2fd9dc_JaffaCakes118.exe
Size

14KB
MD5

bf25180b8ed06fe66cf08f4fbe2fd9dc
SHA1

8184532015386b547cd622565e2560611a5edb40
SHA256

ad646fd863ac36bba5a7b404d9e19a23a45300b8c881434ec118f658961abb3a
SHA512

175d8f59d0444953bb355f9376fd88d479b953c4f5c2491e98b7d672b9761379d697af8dc9f0c59024623311397fb606835f8738a94725eb77374ee18c47552f
SSDEEP

192:n0swIPBiCWY8vJpT7/FksuK7HbWKzwxzwQhr2g/RARtcvs3eBeY7l2fI1Iz++BVm:aIf8D7d6gWKzw3D5ARtosyeUvi+iVm

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2876-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/2876-2-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Startup Manager = "C:\\Windows\\system32\\sys32.exe"	bf25180b8ed06fe66cf08f4fbe2fd9dc_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sys32.exe	bf25180b8ed06fe66cf08f4fbe2fd9dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sys32.exe	bf25180b8ed06fe66cf08f4fbe2fd9dc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bf25180b8ed06fe66cf08f4fbe2fd9dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf25180b8ed06fe66cf08f4fbe2fd9dc_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2876-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2876-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads