6679abb38295e55098a0fd5051a38359e4806db5b324653dfb3c6e34bc9437be | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:07

Sharing

Report Analysis Logs

General

Target

68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Size

40KB
MD5

68f27fef6ae40ee58fd68f9a2bb61df2
SHA1

94cd446e5068a3c2f6570878f301d6a68ac1a152
SHA256

6679abb38295e55098a0fd5051a38359e4806db5b324653dfb3c6e34bc9437be
SHA512

bdab9818a73087ecfdacf52e23cbc7208611e7cf80ba3ffabd8e63f3218c5845efbfecc2d61b47bf3acb5a8432d08730d0f8b461ffee408a373df74ca502dbe3
SSDEEP

384:kYn8/UNkGbFwf/uPyUZQpFWuWaF59tQxWO2xzVsjnlgQv02HCSr:dsGkGbFwHyyUyH59rJxunL02iS

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Windows\Fonts\MbsV2QQJe.fon	acprotect

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2560 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

pid process

2548 68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
\Windows\Fonts\MbsV2QQJe.fon	upx
behavioral1/memory/2548-5-0x0000000010000000-0x0000000010010000-memory.dmp	upx
behavioral1/memory/2548-7-0x0000000010000000-0x0000000010010000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

Processes:

68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\fOnts\PeMTdMfqzpGTb5ps.Ttf	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
File opened for modification	C:\Windows\fonts\MbsV2QQJe.fon	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 7 IoCs

Processes:

68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91F5C9DB-ACD1-4812-BAB9-6F5AE433930A}\InprocServer32\ = "C:\\Windows\\fonts\\MbsV2QQJe.fon"	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91F5C9DB-ACD1-4812-BAB9-6F5AE433930A}\InprocServer32\ThreadingModel = "Apartment"	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID\{91F5C9DB-ACD1-4812-BAB9-6F5AE433930A}\InprocServer32	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91F5C9DB-ACD1-4812-BAB9-6F5AE433930A}	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91F5C9DB-ACD1-4812-BAB9-6F5AE433930A}\InprocServer32	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

pid	process
2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

pid process

2548 68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

description	pid	process	target process
PID 2548 wrote to memory of 2560	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe	cmd.exe
PID 2548 wrote to memory of 2560	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe	cmd.exe
PID 2548 wrote to memory of 2560	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe	cmd.exe
PID 2548 wrote to memory of 2560	2548	68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\68F27F~1.EXE >> NUL
2⤵
- Deletes itself
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Fonts\MbsV2QQJe.fon

Filesize
16KB

MD5
1cf2f002ea7ab9eb6957191a7cfee864

SHA1
8950775b27dd0b1ddd49afa841cce6a867fc9b09

SHA256
34a239da585600b78869180560496b4894655ed96e45872f42954122691206c1

SHA512
23eb5a82e49a2264484c740ea6f1f1ff7456478770f539017f12f1542b757712db53de244c4fb6865cfa6fbfd8aaab85ede6c0e3d79b9470cf435e43ab872aff

Download Submit
memory/2548-5-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2548-7-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download