826945495608ff2d0a5355e167f86242f63c835d22138bb344cba64be8777621

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe
Size

16KB
MD5

05990453568accde954c1f3b1c19a9e8
SHA1

c09cacf53b140f10821cc64428a6108c2bc67ad0
SHA256

826945495608ff2d0a5355e167f86242f63c835d22138bb344cba64be8777621
SHA512

2cf1fd29f9547fd1a7be6ce2e0326f9b35c5c79367eae9d9b146c288e95d299805fab53527a19859b75d218f08f7ed1df22c06a0be34baaab26bf1fa9f664487
SSDEEP

384:x8+2e/bNZ+JcCn94qAVi7RnF9H0YnFhy4NpywZH:fP/pZ+JcC94qAMFnF9HNnptd

Score

8^/10

persistence privilege_escalation upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\msosmsfpfis64.sys	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Deletes itself 1 IoCs

pid	Process
2592	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-1-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2220-88-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msosmhfp00.dll	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msosmhfp00.dll	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msosmhfp.dat	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe
2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe
2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
476	services.exe
476	services.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 256	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	1
PID 2220 wrote to memory of 336	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	2
PID 2220 wrote to memory of 384	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	3
PID 2220 wrote to memory of 392	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	4
PID 2220 wrote to memory of 432	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	5
PID 2220 wrote to memory of 476	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	6
PID 2220 wrote to memory of 492	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	7
PID 2220 wrote to memory of 500	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	8
PID 2220 wrote to memory of 604	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	9
PID 2220 wrote to memory of 684	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	10
PID 2220 wrote to memory of 748	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	11
PID 2220 wrote to memory of 808	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	12
PID 2220 wrote to memory of 856	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	13
PID 2220 wrote to memory of 964	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	15
PID 2220 wrote to memory of 236	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	16
PID 2220 wrote to memory of 296	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	17
PID 2220 wrote to memory of 1072	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	18
PID 2220 wrote to memory of 1112	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	19
PID 2220 wrote to memory of 1168	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	20
PID 2220 wrote to memory of 1196	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	21
PID 2220 wrote to memory of 2040	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	23
PID 2220 wrote to memory of 2364	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	24
PID 2220 wrote to memory of 2484	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	25
PID 2220 wrote to memory of 2592	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2592	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2592	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2592	2220	05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe	28

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  - Suspicious behavior: LoadsDriver
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:604
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:2040
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:684
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:748
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:808
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1168
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:856
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:964
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:236
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:296
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1072
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1112
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2364
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2484
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\05990453568accde954c1f3b1c19a9e8_JaffaCakes118.exe"
    3⤵
    - Deletes itself
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\tmp1EB8.tmp

Filesize
9KB

MD5
4fbd86a8a8f6938ad7acfc30ff74485a

SHA1
4a078df9945e02503daf54d4ab13ee4c0f17d746

SHA256
c3b1ae7e0901386b087bc3c3b9b91d728507739fdfbeec871805c2d861d7f95a

SHA512
21729bc1692c3b58912fda171bb17c1b3e72e34ba58b6938c39f80609fdd3c0aa10b8588686a07c39673355c590cab19985915995c63f0df333b6b79464a3a02

Download Submit
memory/256-11-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/392-23-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2220-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2220-10-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/2220-88-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download