Analysis

  • max time kernel
    15s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/04/2024, 16:36

Errors

Reason
Machine shutdown

General

  • Target

    f180a4af78bb836a4c3066d71a661b61_JaffaCakes118.exe

  • Size

    244KB

  • MD5

    f180a4af78bb836a4c3066d71a661b61

  • SHA1

    b2143f40f04dd4cfec440e0c16374e42398bc22f

  • SHA256

    818600adaf5273806f91e8cc0ad675ff20404bb19d32aeee04d109c10af02514

  • SHA512

    25020d8baf8a34e50f889e3766be9ef939e7a080a75191a0f39859a0ddb5ddf87eed4d067f5fa6863c50159cf347b0c5d05ad0a62675a2224baba0ebcbb60210

  • SSDEEP

    6144:uyjQpFF0pZ8zFk2tN8zft91zKjL4nRvPZrK+8Mzs8:oM5zmoLg8

Malware Config

Signatures

  • Sets DLL path for service in the registry 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 5 IoCs
  • Modifies data under HKEY_USERS 49 IoCs
  • Modifies registry class 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f180a4af78bb836a4c3066d71a661b61_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f180a4af78bb836a4c3066d71a661b61_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\AppData\Local\Temp\ovc.exe
      "C:\Users\Admin\AppData\Local\Temp\ovc.exe"
      2⤵
      • Sets DLL path for service in the registry
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1520
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Sets DLL path for service in the registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:1684
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2152
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2156

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\fsutk.dll

        Filesize

        116KB

        MD5

        580f569dcb096d620a97007fe3686f94

        SHA1

        810b672bedab092b8ff4430cce94d9747f79447a

        SHA256

        59449cb05ae5bee7abe633471279887801ad9a2f1f3e55381b767a8e41f4813c

        SHA512

        dafbe236906c057f451a474bf8d09fde907095c3fe1efc1502f9713a899b8b4ac9e1b72e3386fc68d5ac1542ad3c9b215385c986d52253b5a0ebaaf654ca3caa

      • \??\c:\$Recycle.bin\int.dat

        Filesize

        220KB

        MD5

        356b3e4d32a88070e6586b7edefe1abe

        SHA1

        6279e068df69c0782efc9ccb22141c02a4228949

        SHA256

        6dcfa04f1f2d9fa1ede9961847b8c2b24168cb68e1a60f1dea2d7704c495d217

        SHA512

        6ba52410c9c23e20bd07371f59e76335fa1df064e7afce9795888049d9960436b5669bbb94f06274ce62f7d04e0d1d4a071c2da3c2ad7ec82465288b68522d69

      • \??\c:\windows\SysWOW64\liprip.dll

        Filesize

        84KB

        MD5

        e08eaa2c83fc093cd66853b945b2d2a6

        SHA1

        5ccb5fd662940e9985b86886cf1730a161534725

        SHA256

        a9fd14eaaeeb1d035089a991bd36db6a799a5f171bd22f267ca19931122d9833

        SHA512

        fdf7fae928ad2ab50a84bc44d401237514e2404370abaa18d63592a377e214e7a0fe542bd3fd362dbb1dd720ca91ccf6417e97ece3a2c423ee43f174efe20fff

      • \Users\Admin\AppData\Local\Temp\ovc.exe

        Filesize

        20KB

        MD5

        339e4f83c06f93c4b69a5e41c9f840f0

        SHA1

        6cb04fa216b13e9c8835914711363527f432f2d8

        SHA256

        9121c6d4b8107e73c14f45e98d42e7eeb56376d9d318e4538c892f1da2903705

        SHA512

        e2be24c33a3aa66221e274c66ce284feb2ea48f7746b0d703677d28352e4fb2e9b40997a1e821fc351e5c7ff539e7ed64935f369fae541b21adc58f1941793bf

      • memory/1684-19-0x00000000001D0000-0x00000000001F0000-memory.dmp

        Filesize

        128KB

      • memory/2152-84-0x0000000002E90000-0x0000000002E91000-memory.dmp

        Filesize

        4KB

      • memory/2156-129-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

        Filesize

        4KB