ad327aae9b70070993566f38f9b3ee5969f8a6e4147850ad2ae258df0eeb0649

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff8919e37b70ac6f6e4d18f48d72d46f_JaffaCakes118.exe
Size

46KB
MD5

ff8919e37b70ac6f6e4d18f48d72d46f
SHA1

bf67c265b561a7d98d7fb5e2c5e5661e3e79f0ce
SHA256

ad327aae9b70070993566f38f9b3ee5969f8a6e4147850ad2ae258df0eeb0649
SHA512

e0807ac008288777a712d448d660cf7a692790266531973ac2950083ff12281bf9dd6f2931552f95f86a28cba049a6a084b958cd575278b96c95d1574144fb08
SSDEEP

768:0oycgGRu+y+o8DVMxgj9YmhELntvkSUkTWiEUq/orT2bn7EK95NKkUakQANp:0oyTC4OMgmmuGSZTrUwrivEE5NcauNp

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2036	netprotocol.exe

Loads dropped DLL 2 IoCs

pid	Process
1240	ff8919e37b70ac6f6e4d18f48d72d46f_JaffaCakes118.exe
1240	ff8919e37b70ac6f6e4d18f48d72d46f_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1240-0-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/files/0x000b0000000144e0-4.dat	upx
behavioral1/memory/2036-12-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	ff8919e37b70ac6f6e4d18f48d72d46f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 2036	1240	ff8919e37b70ac6f6e4d18f48d72d46f_JaffaCakes118.exe	28
PID 1240 wrote to memory of 2036	1240	ff8919e37b70ac6f6e4d18f48d72d46f_JaffaCakes118.exe	28
PID 1240 wrote to memory of 2036	1240	ff8919e37b70ac6f6e4d18f48d72d46f_JaffaCakes118.exe	28
PID 1240 wrote to memory of 2036	1240	ff8919e37b70ac6f6e4d18f48d72d46f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\ff8919e37b70ac6f6e4d18f48d72d46f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff8919e37b70ac6f6e4d18f48d72d46f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Roaming\netprotocol.exe
  C:\Users\Admin\AppData\Roaming\netprotocol.exe
  2⤵
  - Executes dropped EXE
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\N6AJ42CL.txt

Filesize
102B

MD5
9ef83a1f6b5e5d20107055a8d2e92606

SHA1
d983ff6add30a0b8af26b38715e3be1cab6e58f2

SHA256
8a6b0bb524540636f2ead83ee714ce9f066fe3b96c1967170bdf44fc028fba15

SHA512
15de8e953fdc8feb9c90bf41c6008c6ce2d43a871c9eded497b5d3c2cb0d25afdf4dff3e646f02aaa420fa2fed48f80e64e29f1781fd78f5457e44bfc213c9d7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\O7OZQHNU.txt

Filesize
102B

MD5
2cd657d414747f1af2cb8fa30d4c5b38

SHA1
19836a07605cccc7bf1ce442bbb38d100422f64b

SHA256
5c2a70e9a95061375cf60c3e52ae83f2d40acf9052f3cca6c5f0fcacce0bc72d

SHA512
b59c7d7c6775706541f32c94d4c39f7ca01cdd991dc435f0404c46fb4a1c6df03c7e70fcbb81c770ae4a4ac4a9f22d11a9df745688392e8610c3d76a10e7a82d

Download Submit
\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
46KB

MD5
8ccac52dc7f003e8fa83d25a78ac1c92

SHA1
c76cb72eec82d41c830f58e5cdf7d3bda6866611

SHA256
e7311e3a0aa57e3b589d717452451763787d250bb2aa392cc54d67dae01c028a

SHA512
c8a77ae7c87e11ee4f146229e08f4d1627a340684f4099448b77a4fe13db4e1993ab881308c80bb7de33509b438475e2d57a207210389843ccc163244a7c2f34

Download Submit
memory/1240-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1240-1-0x0000000000220000-0x0000000000227000-memory.dmp

Filesize
28KB

Download
memory/1240-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1240-10-0x0000000000260000-0x0000000000288000-memory.dmp

Filesize
160KB

Download
memory/1240-14-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2036-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2036-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads