f2fe64f487a40a76b52e459513a5b64827e7f1222343ce8953ae087264171bd1

Analysis

max time kernel
151s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe
Size 78KB
Sample240410-v38nrsab21
SHA256 f2fe64f487a40a76b52e459513a5b64827e7f1222343ce8953ae087264171bd1
MD5 eb9d83883aeb809ffeaede845a4e84f3
SHA1 e883cc67717319cab15f97018186e6cf216b633c
SHA512 fb958e97ed77aa1944f04a76c21171acab5100787542cfa52a328b293e9a3a6ebf44397fbd0f53967c4e942b18ea71b91dbcea9c9352323722bbddadb28bd6e2
SSDEEP 1536:HRWV5jSwXT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQtd6z9/r13E:HRWV5jSoSyRxvHF5vCbxwpI6Ws9/i
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2372	tmp64EB.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
1992	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe
1992	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\aspnet_perf2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mscordbi.exe\""	tmp64EB.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe
Token: SeDebugPrivilege	2372	tmp64EB.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 3008	1992	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	28
PID 1992 wrote to memory of 3008	1992	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	28
PID 1992 wrote to memory of 3008	1992	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	28
PID 1992 wrote to memory of 3008	1992	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	28
PID 3008 wrote to memory of 2640	3008	vbc.exe	30
PID 3008 wrote to memory of 2640	3008	vbc.exe	30
PID 3008 wrote to memory of 2640	3008	vbc.exe	30
PID 3008 wrote to memory of 2640	3008	vbc.exe	30
PID 1992 wrote to memory of 2372	1992	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	31
PID 1992 wrote to memory of 2372	1992	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	31
PID 1992 wrote to memory of 2372	1992	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	31
PID 1992 wrote to memory of 2372	1992	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7r--jdet.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6817.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6816.tmp"
    3⤵
    PID:2640
- C:\Users\Admin\AppData\Local\Temp\tmp64EB.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp64EB.tmp.exe" C:\Users\Admin\AppData\Local\Temp\eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7r--jdet.0.vb

Path C:\Users\Admin\AppData\Local\Temp\7r--jdet.0.vb
Size 14KB
SHA256 a33e51264f21a889490733eee4c90b8db2029bcb3e1be66b9260cf831bcf530c
MD5 5a98f5b49ccb4f0961357027b0cdb30e
SHA1 a29d896a584c0557f39d60d65652012976efb565
SHA512 1b71655a5dc98f2e1aa04570f0e09e57d0795acb174173a5799ad9fc52e94607363399d900db43e17fa16c7880634aee368463d605f328ef5ee81255c4a4d62a
SSDEEP 384:r3N7yNmpN7NnX3VVNFNgcHbzE6NnzN7Q7SN7eP:BKoJnV3gcHrnhs+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

7r--jdet.cmdline

Path C:\Users\Admin\AppData\Local\Temp\7r--jdet.cmdline
Size 266B
SHA256 7c3830f68de3a74f243f9d4806be6d15d45905ddb28d27ae95cd2de3214287c2
MD5 46a5df027b8cc1732c28008d114dc5b5
SHA1 a07113ed803ec83b86269227ee5e621e409436bb
SHA512 f8d95b5205c4d6623e3814a1a165972006798fcabfed68762a05febf7906cadcd3fafdbf33a519490f306b098af1eef3e29581cd06ee8b743c5ddd5e610cf911
MD5 SHA1 SHA512

Submit Download

RES6817.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6817.tmp
Size 1KB
SHA256 98582b415cd339975f32b4b42bb786cdcd3019909d5d9f52ebf0b2699b91ef63
MD5 97b7af66a41fb94f10a7e413f058c9f2
SHA1 e68ff261ba21889481ef34913c07a62594865fb7
SHA512 ef98fcac7074c644f751db9374a9bca6391b599b817424a31fed4dfe1365121c21dfe8d8e9b097006b046fdcc2851468ce40e32c797f239288314d3dcc92e386
MD5 SHA1 SHA512

Submit Download

tmp64EB.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp64EB.tmp.exe
Size 78KB
SHA256 fc34be629039d58e72e403b7cfee988ded753d4419f6e66cf97eecfe579eaa30
MD5 c1f70e0f6e91cfdbb151bd783acab9fc
SHA1 cf979952ddde49f77af52be52984e79ce20815ab
SHA512 4e65fd7210257d8e1686693eb6f0de82c54640e80100a0b8e951d0f10a915be4f184d77429213687f0ff3132ca0bc4c16d625ed668a5c5cc642b3746b854ea2e
SSDEEP 1536:1uHHJIdXT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQt+6G9/ro15v:1uHpINSyRxvHF5vCbxwpI6W+6G9/rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc6816.tmp

Path C:\Users\Admin\AppData\Local\Temp\vbc6816.tmp
Size 660B
SHA256 63a8ff8ebe4c4d40e1a7065d0c688666dd887157000ae26b938c5b3897e20b79
MD5 be68cc4c624e855ac549306084de64fa
SHA1 dc53565777c29cdd214c1b724d3287274b853dee
SHA512 fe429dfdb0873cc2fe985a5c099667d5b529bee58c6fbba558109c8db98f8fb0cac085a024e123c24a7533f1dd37918e1ad9dec16e5928fe0102a5356e81363b
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 e2eb52524ddfed5e52a54484b3fecdc9ebe24fb141d1445d37c99c0ab615df4f
MD5 097dd7d3902f824a3960ad33401b539f
SHA1 4e5c80de6a0886a8b02592a0c980b2bc2d9a4a8f
SHA512 bb77c3f7b9b8c461b149f540a0dab99fdde474484b046d663228d8c0f1b6a20b72892643935069dd74134c8ab8e8f26b6badc210a6929a737541b9861007fbe4
SSDEEP 1536:0XT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQtQ:sSyRxvHF5vCbxwpI6WQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1992-6-0x00000000009E0000-0x0000000000A20000-memory.dmp

Download

memory/1992-2-0x00000000743E0000-0x000000007498B000-memory.dmp

Download

memory/1992-0-0x00000000743E0000-0x000000007498B000-memory.dmp

Download

memory/1992-22-0x00000000743E0000-0x000000007498B000-memory.dmp

Download

memory/2372-24-0x00000000002E0000-0x0000000000320000-memory.dmp

Download

memory/2372-23-0x00000000743E0000-0x000000007498B000-memory.dmp

Download

memory/2372-25-0x00000000743E0000-0x000000007498B000-memory.dmp

Download

memory/2372-27-0x00000000002E0000-0x0000000000320000-memory.dmp

Download

memory/2372-29-0x00000000002E0000-0x0000000000320000-memory.dmp

Download

memory/2372-28-0x00000000743E0000-0x000000007498B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads