Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    16-05-2024 12:06

General

  • Target

    4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    4afb95d53f83e1dea370b2f501307dda

  • SHA1

    25bdb482d40b3b9d29b36774c4bcc3fd090f0624

  • SHA256

    51d0bc63f05586fc726d57103a8067636dcfcef391cc15025cde2d82cc83dcfd

  • SHA512

    f8f6297f44dd6c898d32b03ec98a2ad43058850047d04524cbbe9de78afb59f013330f92e9006430a5414c07ce10a9fc2cd3b93d41d8b29899bfc3957199ec36

  • SSDEEP

    12288:RFfwcHcu8pMkZ3Fn9d+Vd3SUZ+7EeI1x7f7V3+hT6DaRWz58kc+1xy8SyG54f:RJcu8pl9d+VdCUhN1SsNK+1pSyw4f

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in System32 directory 7 IoCs
  • Drops file in Windows directory 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Windows\SysWOW64\fservice.exe
      C:\Windows\system32\fservice.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\services.exe
        C:\Windows\services.exe -XP
        3⤵
        • Modifies WinLogon for persistence
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:2988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\fservice.exe

    Filesize

    1.9MB

    MD5

    4afb95d53f83e1dea370b2f501307dda

    SHA1

    25bdb482d40b3b9d29b36774c4bcc3fd090f0624

    SHA256

    51d0bc63f05586fc726d57103a8067636dcfcef391cc15025cde2d82cc83dcfd

    SHA512

    f8f6297f44dd6c898d32b03ec98a2ad43058850047d04524cbbe9de78afb59f013330f92e9006430a5414c07ce10a9fc2cd3b93d41d8b29899bfc3957199ec36

  • \Windows\SysWOW64\reginv.dll

    Filesize

    36KB

    MD5

    562e0d01d6571fa2251a1e9f54c6cc69

    SHA1

    83677ad3bc630aa6327253c7b3deffbd4a8ce905

    SHA256

    c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6

    SHA512

    166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea

  • \Windows\SysWOW64\winkey.dll

    Filesize

    13KB

    MD5

    b4c72da9fd1a0dcb0698b7da97daa0cd

    SHA1

    b25a79e8ea4c723c58caab83aed6ea48de7ed759

    SHA256

    45d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f

    SHA512

    f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066

  • memory/2280-0-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2280-36-0x0000000000400000-0x00000000005F8000-memory.dmp

    Filesize

    2.0MB

  • memory/2976-12-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

  • memory/2976-33-0x0000000000400000-0x00000000005F8000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-22-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2988-26-0x0000000010000000-0x000000001000B000-memory.dmp

    Filesize

    44KB

  • memory/2988-38-0x0000000010000000-0x000000001000B000-memory.dmp

    Filesize

    44KB

  • memory/2988-37-0x0000000000400000-0x00000000005F8000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-41-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB