735a8c7468aee445a55b1b882e8efba7abf7cc49113e510aba055b5e6455931f

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe
Size

18KB
MD5

fe6117df62a36d0d88f0d2f2f7307032
SHA1

0dd8b35d89ba3b9c1f7dd8435888d7594d37e657
SHA256

735a8c7468aee445a55b1b882e8efba7abf7cc49113e510aba055b5e6455931f
SHA512

d1f1dd2cf7b601e45111ab494d772957d94007fe31e9b7e25478aa9f64fa4842d23950ff73190866d1c56c5baca68e09128f09891f392a3540df4dd80ae63ace
SSDEEP

384:4eLxa+hi/juX+F3Du6bTsVKfDyB7q9kr:4+xaukdDp7k+u

Score

1^/10

Malware Config

Signatures

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2352	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe
Token: SeDebugPrivilege	1524	fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe
Token: SeDebugPrivilege	1300	fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2352	1648	fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe	30
PID 1648 wrote to memory of 2352	1648	fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe	30
PID 1648 wrote to memory of 2352	1648	fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe	30
PID 2944 wrote to memory of 1524	2944	taskeng.exe	33
PID 2944 wrote to memory of 1524	2944	taskeng.exe	33
PID 2944 wrote to memory of 1524	2944	taskeng.exe	33
PID 2944 wrote to memory of 1300	2944	taskeng.exe	34
PID 2944 wrote to memory of 1300	2944	taskeng.exe	34
PID 2944 wrote to memory of 1300	2944	taskeng.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\system32\schtasks.exe
  schtasks /create /sc minute /mo 1 /tn "HD" /tr "C:\Users\Admin\AppData\Local\Temp\fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2352

C:\Windows\system32\taskeng.exe
taskeng.exe {1D6D5A75-54D5-4C7B-9FAF-8EA6BE17FABA} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Users\Admin\AppData\Local\Temp\fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fe6117df62a36d0d88f0d2f2f7307032_JaffaCakes118.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-5-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/1524-6-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/1524-7-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/1524-8-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/1648-0-0x000007FEF60AE000-0x000007FEF60AF000-memory.dmp

Filesize
4KB

Download
memory/1648-1-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/1648-2-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/1648-3-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/1648-4-0x000007FEF60AE000-0x000007FEF60AF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads