5bef40ada35f18a826b25404aebebc8143e898411d1db77a61f79efa2c018ad7

Analysis

max time kernel
159s
max time network
125s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe
Size

166KB
MD5

ead21fb652823bb0861ac73a96b23abb
SHA1

815e706d7b3fb32adf45bf4aa5759ebdef14e3cc
SHA256

5bef40ada35f18a826b25404aebebc8143e898411d1db77a61f79efa2c018ad7
SHA512

003fdb1f95accfda593dddabc5d0ddd342c43d098f9955da4e083d260cf4e100644e2c7c3223c807fc76a3b0869395d599b15baaaa1f4be8957453910d0d0437
SSDEEP

3072:W0A2QfyV2jXJx+SuH7W575zgrUpWNPFNmHC1NFPqoLFTfPJEA/1w/sgWWr8pIOVl:W0Pexo27pgrvFmEHJnSs1wYzpIOV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2240	NewSrv3.exe
1732	iPatch.exe

Loads dropped DLL 6 IoCs

pid	Process
2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe
2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe
2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe
1732	iPatch.exe
1732	iPatch.exe
1732	iPatch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	NewSrv3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	NewSrv3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	NewSrv3.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2240	2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe	27
PID 2356 wrote to memory of 2240	2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe	27
PID 2356 wrote to memory of 2240	2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe	27
PID 2356 wrote to memory of 2240	2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe	27
PID 2356 wrote to memory of 1732	2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe	28
PID 2356 wrote to memory of 1732	2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe	28
PID 2356 wrote to memory of 1732	2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe	28
PID 2356 wrote to memory of 1732	2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe	28
PID 2356 wrote to memory of 1732	2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe	28
PID 2356 wrote to memory of 1732	2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe	28
PID 2356 wrote to memory of 1732	2356	ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ead21fb652823bb0861ac73a96b23abb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\NewSrv3.exe
  "C:\Users\Admin\AppData\Local\Temp\NewSrv3.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\iPatch.exe
  "C:\Users\Admin\AppData\Local\Temp\iPatch.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\NewSrv3.exe

Filesize
93KB

MD5
3efa7fb495c824e4a95d00cc66430fe8

SHA1
9774c31e329255a48141ff1cc222910c2ee88668

SHA256
c771b008506ae133929d72f5bd69f503de70b02b2e746cd103e00f8850b400ab

SHA512
9fb1ed7e2bd6b2292d2b8ef100bc790a0b0fb462bc2b0087735ba81c1a3fe08af2d503dff4d04835414c0356edeb5db949c57c3595ec389a1af4705bdab153af

Download Submit
\Users\Admin\AppData\Local\Temp\iPatch.exe

Filesize
69KB

MD5
59ca358d62b768bdbe842e356a8a799c

SHA1
f81e4eb5e4ce5eb2a02c25dba86c35f166eb4b34

SHA256
5d5e85edac16fc502eab12d31903d054aea8132f5f27c38d78d65d7e2aec0c77

SHA512
4335694d074f26b4dc3ec1ec437e442228a10e286150e676f50e088ade18fb74214a2a01af055a2ec913cd141f89ee837220a646818ae184cff608877425a1d7

Download Submit
memory/1732-23-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1732-33-0x0000000000020000-0x000000000003E000-memory.dmp

Filesize
120KB

Download
memory/1732-31-0x0000000000020000-0x000000000003E000-memory.dmp

Filesize
120KB

Download
memory/1732-30-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1732-27-0x0000000000020000-0x000000000003E000-memory.dmp

Filesize
120KB

Download
memory/1732-28-0x0000000000020000-0x000000000003E000-memory.dmp

Filesize
120KB

Download
memory/2240-19-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2240-12-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2356-21-0x0000000000400000-0x000000000042B4A1-memory.dmp

Filesize
173KB

Download
memory/2356-18-0x0000000002650000-0x000000000266E000-memory.dmp

Filesize
120KB

Download
memory/2356-0-0x0000000000400000-0x000000000042B4A1-memory.dmp

Filesize
173KB

Download
memory/2356-17-0x0000000002640000-0x000000000265C000-memory.dmp

Filesize
112KB

Download
memory/2356-5-0x0000000002640000-0x000000000265C000-memory.dmp

Filesize
112KB

Download