Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-05-2024 12:06

General

  • Target

    4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    4afb95d53f83e1dea370b2f501307dda

  • SHA1

    25bdb482d40b3b9d29b36774c4bcc3fd090f0624

  • SHA256

    51d0bc63f05586fc726d57103a8067636dcfcef391cc15025cde2d82cc83dcfd

  • SHA512

    f8f6297f44dd6c898d32b03ec98a2ad43058850047d04524cbbe9de78afb59f013330f92e9006430a5414c07ce10a9fc2cd3b93d41d8b29899bfc3957199ec36

  • SSDEEP

    12288:RFfwcHcu8pMkZ3Fn9d+Vd3SUZ+7EeI1x7f7V3+hT6DaRWz58kc+1xy8SyG54f:RJcu8pl9d+VdCUhN1SsNK+1pSyw4f

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in System32 directory 7 IoCs
  • Drops file in Windows directory 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Windows\SysWOW64\fservice.exe
      C:\Windows\system32\fservice.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Windows\services.exe
        C:\Windows\services.exe -XP
        3⤵
        • Modifies WinLogon for persistence
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:3240
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4488,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:8
    1⤵
      PID:452

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\fservice.exe

      Filesize

      1.9MB

      MD5

      4afb95d53f83e1dea370b2f501307dda

      SHA1

      25bdb482d40b3b9d29b36774c4bcc3fd090f0624

      SHA256

      51d0bc63f05586fc726d57103a8067636dcfcef391cc15025cde2d82cc83dcfd

      SHA512

      f8f6297f44dd6c898d32b03ec98a2ad43058850047d04524cbbe9de78afb59f013330f92e9006430a5414c07ce10a9fc2cd3b93d41d8b29899bfc3957199ec36

    • C:\Windows\SysWOW64\reginv.dll

      Filesize

      36KB

      MD5

      562e0d01d6571fa2251a1e9f54c6cc69

      SHA1

      83677ad3bc630aa6327253c7b3deffbd4a8ce905

      SHA256

      c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6

      SHA512

      166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea

    • C:\Windows\SysWOW64\winkey.dll

      Filesize

      13KB

      MD5

      b4c72da9fd1a0dcb0698b7da97daa0cd

      SHA1

      b25a79e8ea4c723c58caab83aed6ea48de7ed759

      SHA256

      45d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f

      SHA512

      f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066

    • memory/1428-8-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

      Filesize

      4KB

    • memory/1428-31-0x0000000000400000-0x00000000005F8000-memory.dmp

      Filesize

      2.0MB

    • memory/3240-17-0x0000000002570000-0x0000000002571000-memory.dmp

      Filesize

      4KB

    • memory/3240-21-0x0000000010000000-0x000000001000B000-memory.dmp

      Filesize

      44KB

    • memory/3240-35-0x0000000010000000-0x000000001000B000-memory.dmp

      Filesize

      44KB

    • memory/3240-34-0x0000000000400000-0x00000000005F8000-memory.dmp

      Filesize

      2.0MB

    • memory/3240-38-0x0000000002570000-0x0000000002571000-memory.dmp

      Filesize

      4KB

    • memory/3240-36-0x0000000000400000-0x00000000005F8000-memory.dmp

      Filesize

      2.0MB

    • memory/4808-0-0x0000000000D10000-0x0000000000D11000-memory.dmp

      Filesize

      4KB

    • memory/4808-33-0x0000000000400000-0x00000000005F8000-memory.dmp

      Filesize

      2.0MB