c9700e31d185d1c94238c32a3ec2638a3c19b8f410968fe8587d13e1eea667f3

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7c3dafc3d93a4ae95954190a0244290_JaffaCakes118.exe
Size

178KB
MD5

f7c3dafc3d93a4ae95954190a0244290
SHA1

4c92d786281c4a5a6655c61e925302f6547363f0
SHA256

c9700e31d185d1c94238c32a3ec2638a3c19b8f410968fe8587d13e1eea667f3
SHA512

0791dbc1e4966fbea1cb058291588f202418c56e04000438036e6bfbf636efb4b430ba3e5cd8376e3483fc288649d8f8d36fd6a4c4652c504129ec3fc24fd58f
SSDEEP

3072:B3KU0uwRWvrVuRn/km7g/GLDGn+4uEhfu9kGLvSN2xZ5mZ4uNXaYFunUerB3dU4C:HwRWvJu9pIGGn+zEDYNxbme6X7KUeV3N

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2872	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
336	csrss.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3036-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3036 set thread context of 2872	3036	f7c3dafc3d93a4ae95954190a0244290_JaffaCakes118.exe	28

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{99d144a9-1252-7ece-38c3-a14db5aabc7e}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99d144a9-1252-7ece-38c3-a14db5aabc7e}\u = "15"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99d144a9-1252-7ece-38c3-a14db5aabc7e}\cid = "6450943168945303827"	explorer.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	explorer.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2872	3036	f7c3dafc3d93a4ae95954190a0244290_JaffaCakes118.exe	28
PID 3036 wrote to memory of 2872	3036	f7c3dafc3d93a4ae95954190a0244290_JaffaCakes118.exe	28
PID 3036 wrote to memory of 2872	3036	f7c3dafc3d93a4ae95954190a0244290_JaffaCakes118.exe	28
PID 3036 wrote to memory of 2872	3036	f7c3dafc3d93a4ae95954190a0244290_JaffaCakes118.exe	28
PID 3036 wrote to memory of 2872	3036	f7c3dafc3d93a4ae95954190a0244290_JaffaCakes118.exe	28
PID 2872 wrote to memory of 336	2872	explorer.exe	2
PID 336 wrote to memory of 2548	336	csrss.exe	29
PID 336 wrote to memory of 2548	336	csrss.exe	29
PID 336 wrote to memory of 2388	336	csrss.exe	30
PID 336 wrote to memory of 2388	336	csrss.exe	30

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Users\Admin\AppData\Local\Temp\f7c3dafc3d93a4ae95954190a0244290_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7c3dafc3d93a4ae95954190a0244290_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\explorer.exe
  00000064*
  2⤵
  - Deletes itself
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2872

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2548

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.DLL

Filesize
31KB

MD5
adf1ddd89d424e8d0e275cc42747ec81

SHA1
321105503846b4a5f8fd3ccd6d92253c39b3e1ce

SHA256
5611fddc5046fce5bbd4d1c1779df429a217b1f952ec973059f7c67e4dfdd46f

SHA512
3afb78bc1e49c224726ae824a4d36923bc9fedbdbc027576427932d900bbb17a3b536f1b384bc52bd1a1892ff23c5a2453065530fbdc0023392a0d17e7cbc184

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
e55695534cfd4970e0783ea3825572d5

SHA1
c6dc6ad11ba04f1654652f6d6b0d7bddc1129c13

SHA256
a1434ede069e5ff28593262c2b15e6c597cdf7e8027bee8df1102780d65b5c57

SHA512
5c22505b6852caeeae912483427e2784458052331f0b0fc596a0af4beeeff56a8478a36102af840390daec8e4b5f11ca5802d738c0ab3cbf74f3eb841c3f504d

Download Submit
memory/336-19-0x0000000002540000-0x000000000254C000-memory.dmp

Filesize
48KB

Download
memory/336-20-0x0000000002540000-0x000000000254C000-memory.dmp

Filesize
48KB

Download
memory/2872-3-0x0000000000210000-0x0000000000224000-memory.dmp

Filesize
80KB

Download
memory/2872-4-0x0000000000060000-0x0000000000072000-memory.dmp

Filesize
72KB

Download
memory/2872-9-0x0000000000210000-0x0000000000224000-memory.dmp

Filesize
80KB

Download
memory/2872-14-0x0000000000210000-0x0000000000224000-memory.dmp

Filesize
80KB

Download
memory/3036-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3036-1-0x0000000000230000-0x0000000000244000-memory.dmp

Filesize
80KB

Download
memory/3036-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download