0db3f1af8d30df957289236ec5a3666cb9491d6cc9179fef61b68e56446ece7c

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe
Size

172KB
MD5

0a61df3421e1230e31a0b3a5a04833bd
SHA1

240655c02895d385f6d76baaf67951d37a2ee5ca
SHA256

0db3f1af8d30df957289236ec5a3666cb9491d6cc9179fef61b68e56446ece7c
SHA512

37566f1bdbe5e8cd14be15d3bb19f29e2178496fc5ac58cd9def0ccbfe06603481d51162ac91ac6a9a9b7357eb194af7c6432cfd33486706d209b3f89f5bd631
SSDEEP

3072:TPOBfbZa0tho080ed+af/ofg9K/J6gGP3JLe9Bxqo:iBfbJXted+AFcUggRYt

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2300-51-0x0000000020010000-0x0000000020064000-memory.dmp	upx
behavioral1/memory/2300-52-0x0000000020010000-0x0000000020064000-memory.dmp	upx
behavioral1/memory/2300-58-0x0000000020010000-0x0000000020064000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssysb = "C:\\Windows\\system32\\0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe"	reg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	cmd.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2776	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2300	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	taskkill.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 1936 wrote to memory of 2300	1936	0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe	28
PID 2300 wrote to memory of 2688	2300	svchost.exe	29
PID 2300 wrote to memory of 2688	2300	svchost.exe	29
PID 2300 wrote to memory of 2688	2300	svchost.exe	29
PID 2300 wrote to memory of 2688	2300	svchost.exe	29
PID 2688 wrote to memory of 2776	2688	cmd.exe	31
PID 2688 wrote to memory of 2776	2688	cmd.exe	31
PID 2688 wrote to memory of 2776	2688	cmd.exe	31
PID 2688 wrote to memory of 2776	2688	cmd.exe	31
PID 2300 wrote to memory of 2116	2300	svchost.exe	34
PID 2300 wrote to memory of 2116	2300	svchost.exe	34
PID 2300 wrote to memory of 2116	2300	svchost.exe	34
PID 2300 wrote to memory of 2116	2300	svchost.exe	34
PID 2300 wrote to memory of 1888	2300	svchost.exe	35
PID 2300 wrote to memory of 1888	2300	svchost.exe	35
PID 2300 wrote to memory of 1888	2300	svchost.exe	35
PID 2300 wrote to memory of 1888	2300	svchost.exe	35

C:\Users\Admin\AppData\Local\Temp\0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im 0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im 0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2776
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c copy /Y "C:\Users\Admin\AppData\Local\Temp\0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe" "C:\Windows\system32\"
    3⤵
    - Drops file in System32 directory
    PID:2116
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /t REG_SZ /f /v mssysb /d "C:\Windows\system32\0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe"
    3⤵
    - Adds Run key to start application
    PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0a61df3421e1230e31a0b3a5a04833bd_JaffaCakes118.exe

Filesize
172KB

MD5
2c02f89de67571d83cb0e5cab8788894

SHA1
12cc58f3fa99f678987f2083a8da056d87753779

SHA256
0cda7bf9211f4d91ae9e65828f0909bd020759dc969f084dd3f62e4ca3896478

SHA512
e018cb278e76e727faa49e3c24ae132c71456043353ae15ccc2de46ceb14690ca4be7c2e8221a999c75fdd7be409e5e39aecbc3cf92cd45cbaf8353d066f948a

Download Submit
memory/1936-0-0x0000000013140000-0x000000001314A000-memory.dmp

Filesize
40KB

Download
memory/2300-3-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2300-7-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2300-46-0x0000000020010000-0x0000000020064000-memory.dmp

Filesize
336KB

Download
memory/2300-50-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/2300-51-0x0000000020010000-0x0000000020064000-memory.dmp

Filesize
336KB

Download
memory/2300-52-0x0000000020010000-0x0000000020064000-memory.dmp

Filesize
336KB

Download
memory/2300-58-0x0000000020010000-0x0000000020064000-memory.dmp

Filesize
336KB

Download