Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2024, 00:48

General

  • Target

    37a48bb5b946eb3a3c49df29588a2b25_JaffaCakes118.exe

  • Size

    41KB

  • MD5

    37a48bb5b946eb3a3c49df29588a2b25

  • SHA1

    1ebd0e12783ebc3e4af1c5c5a8ca776c53beaa51

  • SHA256

    e78ba7e1776595571dfd6f5a8a54cf368d2d652ecfb31dd8fb53ff4f56095486

  • SHA512

    ef56e31141cc3285195061e42c301ba482581fa409b9c5d3c8b21d235930a718bb73311b99111ad945efb74cb1a2705e8b253f26ee9c0232cc2498c5f6240bf1

  • SSDEEP

    768:IZ8d0s/fUhO6kdF0eMGD4UP6U/ozLZX4fyX/J:m8dahjk4eesozNXEs

Malware Config

Signatures

  • Event Triggered Execution: AppCert DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.

  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Drops file in System32 directory 2 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\37a48bb5b946eb3a3c49df29588a2b25_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\37a48bb5b946eb3a3c49df29588a2b25_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: RenamesItself
    PID:2132

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2132-0-0x0000000000401000-0x000000000040B000-memory.dmp

          Filesize

          40KB

        • memory/2132-4-0x0000000000401000-0x000000000040B000-memory.dmp

          Filesize

          40KB

        • memory/2132-3-0x0000000000400000-0x000000000040D000-memory.dmp

          Filesize

          52KB