417ed65afaa6823d7ed7f66a24e820b0182be5738a624198189ed78fc6445513

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 19:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
Size

4.1MB
MD5

4b6b1652b90dc007b546f5120897d972
SHA1

ad1fbf14b75cce2ee98039b4632c1a1c86082268
SHA256

417ed65afaa6823d7ed7f66a24e820b0182be5738a624198189ed78fc6445513
SHA512

1cff1bf9692cf561d6f7694ccc4c7af674731d1961919623acc09724bbc77ffdb3683e44a2160c9f26a85a3830c3338d8fa44d805ee251237f070a0aa442844d
SSDEEP

98304:+R0pI/IQlUoMPdmpSp04ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm75n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3028	aoptisys.exe

Loads dropped DLL 1 IoCs

pid	Process
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesJM\\aoptisys.exe"	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidOQ\\optidevsys.exe"	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
3028	aoptisys.exe
2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3028	2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe	28
PID 2876 wrote to memory of 3028	2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe	28
PID 2876 wrote to memory of 3028	2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe	28
PID 2876 wrote to memory of 3028	2876	4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b6b1652b90dc007b546f5120897d972_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876
- C:\FilesJM\aoptisys.exe
  C:\FilesJM\aoptisys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
202B

MD5
b66fcd35a940a2fc0e93ede20f19a00d

SHA1
429e45d131ba25216b96720398e233d25200ea1d

SHA256
ffc2542aa27063e8f1cf665f6a64967163e6dfc12a4d6c98462f7532e9d28402

SHA512
af1820d529b529e7c18da1e4f96d6212dc96b5efd717fe5fb1a32cab72c4927a512767617f4310c4871fb4ff7f63a1fcc11cc2fe59048bf2960659442d6e30e0

Download Submit
C:\VidOQ\optidevsys.exe

Filesize
4.1MB

MD5
1ad8cf32d4a86d6ac3dcdf1e128ab74f

SHA1
c1d0cd658aec4b63bc0821fc2f4849a58d1384ba

SHA256
efd16710c8f98a5da4271324d21b19d6d241594d74ff71c3479f103c42b626c8

SHA512
98f029ac2d10353bd68eccc8d535490027373153c0985cc39a328f5b8154cfbb695622609a4f89526cd255c73f723495463ce52febdd4b9b36f3ee7a3b283db1

Download Submit
\FilesJM\aoptisys.exe

Filesize
4.1MB

MD5
01df197f1dcb1d60bab4c27f8d04baae

SHA1
ad396a9ebe8ba65f107bf9f76be348e8753524bf

SHA256
d7950a2fb35007dfb979b46f282d47405c9de5c6cc185a8d5ef65fdbeaa51949

SHA512
a72d5b4bd9408e02f22e6f7513c029bdc96bf0317c523b3756d5c5c9ee20e07288354b416e970f90a054ba0b3d060e9a93957506e1cd3ebc3e2d4148ff37492f

Download Submit