Analysis

  • max time kernel
    148s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 10:29

General

  • Target

    3f09fbc368f17edb61193d5db5ee0749_JaffaCakes118.exe

  • Size

    70KB

  • MD5

    3f09fbc368f17edb61193d5db5ee0749

  • SHA1

    e6b725fcf7c69c251ca05b6fac7816c0b9579d52

  • SHA256

    253c088b88328696a1b70dd570fb0372c912a7b7a5eeb703d2cc7d29b2cdbf32

  • SHA512

    d068ca2291e4363ef070b0d2bfe81adc7eb656d978c97c22f7e6bd6b5a4b5a2939fe996753ce0d3cf7271cf45a346dfc9297e92bd00e4798804b9db37d0aa2b9

  • SSDEEP

    1536:CNCRz5fBMn24kEuqzcEjI+uYJU1YRqo1Wujp2zN5X:tiHkEuqdVBUEqo/l2zN9

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Deletes itself 1 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f09fbc368f17edb61193d5db5ee0749_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3f09fbc368f17edb61193d5db5ee0749_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Users\Admin\AppData\Local\Temp\3f09fbc368f17edb61193d5db5ee0749_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3f09fbc368f17edb61193d5db5ee0749_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Windows\SysWOW64\svchost.exe
        "svchost.exe" path<<c:\users\admin\appdata\local\temp\3f09fbc368f17edb61193d5db5ee0749_jaffacakes118.exe>>path
        3⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2912
        • C:\Windows\SysWOW64\svchost.exe
          "svchost.exe" path<<c:\users\admin\appdata\local\temp\3f09fbc368f17edb61193d5db5ee0749_jaffacakes118.exe>>path
          4⤵
          • Modifies WinLogon for persistence
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Deletes itself
          • Adds Run key to start application
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          PID:2084

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\KB7756356\KB7756356.exe

          Filesize

          70KB

          MD5

          3f09fbc368f17edb61193d5db5ee0749

          SHA1

          e6b725fcf7c69c251ca05b6fac7816c0b9579d52

          SHA256

          253c088b88328696a1b70dd570fb0372c912a7b7a5eeb703d2cc7d29b2cdbf32

          SHA512

          d068ca2291e4363ef070b0d2bfe81adc7eb656d978c97c22f7e6bd6b5a4b5a2939fe996753ce0d3cf7271cf45a346dfc9297e92bd00e4798804b9db37d0aa2b9

        • memory/1996-1-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

        • memory/1996-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

          Filesize

          4KB

        • memory/2084-16-0x0000000000B20000-0x0000000000B3D000-memory.dmp

          Filesize

          116KB

        • memory/2084-65-0x0000000000B20000-0x0000000000B3D000-memory.dmp

          Filesize

          116KB

        • memory/2084-49-0x0000000000B20000-0x0000000000B3D000-memory.dmp

          Filesize

          116KB

        • memory/2084-33-0x0000000000B20000-0x0000000000B3D000-memory.dmp

          Filesize

          116KB

        • memory/2084-26-0x0000000000B20000-0x0000000000B3D000-memory.dmp

          Filesize

          116KB

        • memory/2084-21-0x0000000000B20000-0x0000000000B3D000-memory.dmp

          Filesize

          116KB

        • memory/2084-17-0x0000000000B20000-0x0000000000B3D000-memory.dmp

          Filesize

          116KB

        • memory/2084-18-0x0000000000B20000-0x0000000000B3D000-memory.dmp

          Filesize

          116KB

        • memory/2084-20-0x0000000000B20000-0x0000000000B3D000-memory.dmp

          Filesize

          116KB

        • memory/2832-5-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/2832-10-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/2832-6-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/2832-4-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/2832-3-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/2832-2-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/2912-15-0x0000000000B20000-0x0000000000B37000-memory.dmp

          Filesize

          92KB

        • memory/2912-12-0x0000000000B20000-0x0000000000B37000-memory.dmp

          Filesize

          92KB

        • memory/2912-11-0x0000000000B20000-0x0000000000B37000-memory.dmp

          Filesize

          92KB

        • memory/2912-9-0x0000000000B20000-0x0000000000B37000-memory.dmp

          Filesize

          92KB