350d32527f9981f33a1f080b9eb2984df7f05eba4e0275f26d00ae69baaad551

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe
Size

13KB
MD5

f90d1b841509a511a80cb3df2901c817
SHA1

50717943cf910d1252b6cd75327219a1274bc5ec
SHA256

350d32527f9981f33a1f080b9eb2984df7f05eba4e0275f26d00ae69baaad551
SHA512

233714f2aeaf848e61125a025bb19c9e3ba80fe2953dcadf085b2d7485a9ca33089a0484d3177f9c4fe82f48efd2e072a8832f130bbabef61f439747d8cb4dd5
SSDEEP

384:nLVguK8/7bpobm6hxlFJBH/umdWxfyZeL6o:pguK8HpobmgxPzvdWVyZe

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Deletes itself 1 IoCs

pid	Process
2460	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2696	cenvtak.exe

Loads dropped DLL 2 IoCs

pid	Process
2492	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe
2492	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2492-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/files/0x000c00000001445e-3.dat	upx
behavioral1/memory/2492-4-0x0000000000230000-0x000000000023F000-memory.dmp	upx
behavioral1/memory/2696-12-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/2492-13-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cenvta.dll	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cenvtak.exe	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cenvtak.exe	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2696	2492	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	28
PID 2492 wrote to memory of 2696	2492	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	28
PID 2492 wrote to memory of 2696	2492	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	28
PID 2492 wrote to memory of 2696	2492	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	28
PID 2492 wrote to memory of 2460	2492	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2460	2492	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2460	2492	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2460	2492	f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\cenvtak.exe
  C:\Windows\system32\cenvtak.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe.bat
  2⤵
  - Deletes itself
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f90d1b841509a511a80cb3df2901c817_JaffaCakes118.exe.bat

Filesize
210B

MD5
9272802650e157dacef7e71d4429f9b6

SHA1
2c724bdddd5ca07c26a595822d232055ab38763a

SHA256
d3ce7d50594b71cde2cac3e9b54437aea625ceeff0fd7c2097f368c9e6e0ef9a

SHA512
926d7334650c6e29a0456b6f4516ec15dc30ba01ed54d6699c99a53106c783faee7f09c0fa0c4488cfadcdb639c60ee2666687017296ceb76e70ad01294bbe97

Download Submit
\Windows\SysWOW64\cenvtak.exe

Filesize
13KB

MD5
f90d1b841509a511a80cb3df2901c817

SHA1
50717943cf910d1252b6cd75327219a1274bc5ec

SHA256
350d32527f9981f33a1f080b9eb2984df7f05eba4e0275f26d00ae69baaad551

SHA512
233714f2aeaf848e61125a025bb19c9e3ba80fe2953dcadf085b2d7485a9ca33089a0484d3177f9c4fe82f48efd2e072a8832f130bbabef61f439747d8cb4dd5

Download Submit
memory/2492-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2492-4-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2492-11-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2492-13-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2492-17-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2696-12-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download