ca0d09d26c01d743029095d07cc99bc6a683d463f6345252d2396651d69c28df

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
Size

63KB
MD5

fe0d3b7c5a36282fc59874050f17678b
SHA1

5abedc73c9da82e73b99b3d90c13a467fc4242b1
SHA256

ca0d09d26c01d743029095d07cc99bc6a683d463f6345252d2396651d69c28df
SHA512

4ecda4d2f8cba3afb7145d2346febc3af406b11c6bf4854e0cc86ccb1758c9adad07ff21ce7cd038d30ae3a0a24cb81e1ba0b97313df2836bbb68ed9950e5dd5
SSDEEP

768:L5xmEXEGDAItPKVFdGei/Q0SU5MF/rKZA464vfaeZrQpSoABi2lATkfc57kOT:LDZUWAItIFweWH5Mt2Zl6A1hlrfcxBT

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2504-0-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-28-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-60-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-91-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-106-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-263-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-264-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-269-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-320-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-325-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-326-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-383-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-398-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-431-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2504-432-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll\DllName = "xpserver.dll"	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll\Asynchronous = "1"	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll\Startup = "ComputerStart"	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll\StartShell = "ExplorerStart"	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll\Shutdown = "ComputerShutdown"	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\avp.txt	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xpsystem.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xpsystem.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xpserver.dll	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Jpg.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaw.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg .exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2504	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
2504	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
2504	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
2504	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
2504	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
2504	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
2504	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
2504	fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe0d3b7c5a36282fc59874050f17678b_JaffaCakes118.exe"
1⤵
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xpsystem.exe

Filesize
88B

MD5
bcd8edb015ddc9e31e8e1b4657c3df43

SHA1
d320e044bc0ed73e557a885a1a47714b8c85200e

SHA256
37646c67c0e8429e6fbfc56678a20fd311cb48d0cb19bb5097078968f0673f37

SHA512
2a1497b35930c516a0f5bf75be460eff986b08d2ed0331dd702be5533b88198a59a41f39252809ef83b455bcf4d07ab0d9723494e8008a9578d0509a643cd6cc

Download Submit
memory/2504-269-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-320-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-106-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-263-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-28-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-264-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-325-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-326-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-383-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-398-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-431-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2504-432-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads