102473af3df3e3a3af680d4bd00e9d329f24dba787147c578ef3f0886f167fb5

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe
Size 15.9MB
Sample240404-qpp72sha3y
SHA256 102473af3df3e3a3af680d4bd00e9d329f24dba787147c578ef3f0886f167fb5
MD5 b97e6ceadb35fc9575cbf741794b2462
SHA1 d9c1f1f3372bee8a2189c30651a9deb5a57892b4
SHA512 450ae31008c0a5027a1b5f3d91ec568879e903fad1e1bb77334bfe17291dcb70b584f5691aadcddc7a2301108a40adb44f43aa09f92a05063d165e9b70efd0d9
SSDEEP 393216:ng7uFg7uFg7uFg7uFg7uFg7uFg7uFg7uN:gSuSuSuSuSuSuSuSN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2516	7D57AD13E21.exe
2600	Scegli_nome_allegato.exe
2712	7D57AD13E21.exe

Loads dropped DLL 3 IoCs

pid	Process
2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe
2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe
2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\7D57AD13E21.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2516 set thread context of 2712	2516	7D57AD13E21.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Scegli_nome_allegato.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	Scegli_nome_allegato.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Scegli_nome_allegato.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2572	reg.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2600	Scegli_nome_allegato.exe
2600	Scegli_nome_allegato.exe
2600	Scegli_nome_allegato.exe
2712	7D57AD13E21.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2572	2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2572	2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2572	2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2572	2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2516	2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe	30
PID 2040 wrote to memory of 2516	2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe	30
PID 2040 wrote to memory of 2516	2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe	30
PID 2040 wrote to memory of 2516	2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe	30
PID 2040 wrote to memory of 2600	2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe	31
PID 2040 wrote to memory of 2600	2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe	31
PID 2040 wrote to memory of 2600	2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe	31
PID 2040 wrote to memory of 2600	2040	b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe	31
PID 2516 wrote to memory of 2712	2516	7D57AD13E21.exe	33
PID 2516 wrote to memory of 2712	2516	7D57AD13E21.exe	33
PID 2516 wrote to memory of 2712	2516	7D57AD13E21.exe	33
PID 2516 wrote to memory of 2712	2516	7D57AD13E21.exe	33
PID 2516 wrote to memory of 2712	2516	7D57AD13E21.exe	33
PID 2516 wrote to memory of 2712	2516	7D57AD13E21.exe	33

C:\Users\Admin\AppData\Local\Temp\b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2572
- C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
  "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
    "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2712
- C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe
  "C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7D57AD13E21.exe

Path \Users\Admin\AppData\Roaming\7D57AD13E21.exe
Size 15.9MB
SHA256 6f4739459036943ddcc992f207cd0c0458b5908c98d2e92ca78d25b0d0d6d5d7
MD5 7acb3a2b7a3ccf0b610dc9180e24270f
SHA1 c4182adc6b678656715bc6bb217a412d35ec0deb
SHA512 181361c888d5370c68b63ec9aa5f2a824cdb4048923155cc3115bcf82f7e4ef3d79f150dbf113059582a71cf8b87318b33382a37a27094f75de262c64ebad542
SSDEEP 393216:Kg7uAg7uAg7uAg7uAg7uAg7uAg7uAg7uN:3StStStStStStStSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Scegli_nome_allegato.exe

Path \Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe
Size 1.0MB
SHA256 ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
MD5 a2f259ceb892d3b0d1d121997c8927e3
SHA1 6e0a7239822b8d365d690a314f231286355f6cc6
SHA512 5ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad
SSDEEP 24576:hIl4VPiOVmQsN5SqOoU3TcnqrqmCKkBTl0:hI+ippSx3urT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2040-19-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/2040-1-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/2040-12-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/2040-0-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2040-21-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2516-41-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/2516-13-0x0000000000330000-0x0000000000331000-memory.dmp

Download

memory/2516-50-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/2600-42-0x0000000000400000-0x00000000004FB000-memory.dmp

Download

memory/2600-22-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2600-27-0x0000000000270000-0x0000000000271000-memory.dmp

Download

memory/2600-56-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2712-44-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/2712-46-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2712-51-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/2712-48-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/2712-52-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/2712-55-0x00000000003A0000-0x00000000003A1000-memory.dmp

Download

memory/2712-54-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/2712-58-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/2712-61-0x00000000003A0000-0x00000000003A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads