c4827d5905806c7f81fccc38fa6aefa0ebdf1710aaaaefe11280ce119a7f3468

Analysis

max time kernel
173s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f95fdec8431c3db7d5a5aa5a72f50d27_JaffaCakes118.exe
Size

4.2MB
MD5

f95fdec8431c3db7d5a5aa5a72f50d27
SHA1

f2c68c9e3d77061e09bdf8ad05638f5bc1f0a40f
SHA256

c4827d5905806c7f81fccc38fa6aefa0ebdf1710aaaaefe11280ce119a7f3468
SHA512

b688f1edbbc1ee136044d57b631677d6b8de17068e0cb07922b1608e1da18897134bb522193ed606f922e7b00b1196fb511cf8602d6dec76ff40f78cec397b77
SSDEEP

98304:pw/NJfSKHjebdvQvhifnRaLGcNa1877Ry0z7IGKhs0+2yW9z:ybHwKiPRGGcg5S0UW9

Score

7^/10

persistence themida

Malware Config

Signatures

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2188-2-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-31-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-35-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-37-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-39-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-40-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-41-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-42-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-43-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-44-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-45-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-46-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-47-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-48-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-49-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida
behavioral1/memory/2188-50-0x0000000000400000-0x0000000000BDD000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows32 = "C:\\Arquivos de programas\\Windows32.exe"	f95fdec8431c3db7d5a5aa5a72f50d27_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MGILJUBR.txt	f95fdec8431c3db7d5a5aa5a72f50d27_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\system\Logfile.txt	f95fdec8431c3db7d5a5aa5a72f50d27_JaffaCakes118.exe
File created	C:\Windows\winload.inf	f95fdec8431c3db7d5a5aa5a72f50d27_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2188	f95fdec8431c3db7d5a5aa5a72f50d27_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2188	f95fdec8431c3db7d5a5aa5a72f50d27_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f95fdec8431c3db7d5a5aa5a72f50d27_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f95fdec8431c3db7d5a5aa5a72f50d27_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-2-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-4-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/2188-3-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download
memory/2188-5-0x0000000004C80000-0x0000000004C82000-memory.dmp

Filesize
8KB

Download
memory/2188-7-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/2188-6-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/2188-8-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/2188-9-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/2188-10-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/2188-11-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/2188-12-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/2188-13-0x0000000004D90000-0x0000000004D92000-memory.dmp

Filesize
8KB

Download
memory/2188-14-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/2188-15-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download
memory/2188-16-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download
memory/2188-17-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/2188-18-0x0000000004FF0000-0x0000000004FF2000-memory.dmp

Filesize
8KB

Download
memory/2188-19-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/2188-20-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/2188-21-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2188-22-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/2188-23-0x00000000050E0000-0x00000000050E2000-memory.dmp

Filesize
8KB

Download
memory/2188-24-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/2188-27-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/2188-28-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/2188-26-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/2188-25-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/2188-29-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/2188-30-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/2188-31-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-36-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/2188-35-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-37-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-38-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2188-39-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-40-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-41-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-42-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-43-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-44-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-45-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-46-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-47-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-48-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-49-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2188-50-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download