1ad79c7025a0a4b2fdb6ee1a50e29eb4637e7eeef733562a232a97a853a44c77

Analysis

max time kernel
141s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c3564dd11e8727a368b0d653654a4b3_JaffaCakes118.exe
Size

118KB
MD5

0c3564dd11e8727a368b0d653654a4b3
SHA1

c2e05fd725e0e1065ffce1d4947414ccb013f06c
SHA256

1ad79c7025a0a4b2fdb6ee1a50e29eb4637e7eeef733562a232a97a853a44c77
SHA512

fb2541565f2735be03e9f016ce9951b2e141d763fedc7ea45d6279363b0cd73ff332ee1067fa1f956ce23cb1e845c77b5db40cf27361ddc960c0a7e98d6153ec
SSDEEP

1536:ZEtB+OyZe0eKfApBLPtFyIWxprOqk44pj3q9w1K1sBNm68emWVo8k1EPX2EShSTr:ZEtB9Se/D5Wxprtcj6im6Dm879X2ExhZ

Score

7^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00090000000155f3-7.dat	aspack_v212_v242

Loads dropped DLL 1 IoCs

pid	Process
1044	0c3564dd11e8727a368b0d653654a4b3_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdoosoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\herss.exe"	0c3564dd11e8727a368b0d653654a4b3_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	1044	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1044	0c3564dd11e8727a368b0d653654a4b3_JaffaCakes118.exe
1044	0c3564dd11e8727a368b0d653654a4b3_JaffaCakes118.exe
1044	0c3564dd11e8727a368b0d653654a4b3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1312	1044	0c3564dd11e8727a368b0d653654a4b3_JaffaCakes118.exe	21
PID 1044 wrote to memory of 1948	1044	0c3564dd11e8727a368b0d653654a4b3_JaffaCakes118.exe	28
PID 1044 wrote to memory of 1948	1044	0c3564dd11e8727a368b0d653654a4b3_JaffaCakes118.exe	28
PID 1044 wrote to memory of 1948	1044	0c3564dd11e8727a368b0d653654a4b3_JaffaCakes118.exe	28
PID 1044 wrote to memory of 1948	1044	0c3564dd11e8727a368b0d653654a4b3_JaffaCakes118.exe	28

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1312
- C:\Users\Admin\AppData\Local\Temp\0c3564dd11e8727a368b0d653654a4b3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0c3564dd11e8727a368b0d653654a4b3_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 164
    3⤵
    - Program crash
    PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\cvasds0.dll

Filesize
97KB

MD5
1b4f146ddff09e3a5120e829a409b139

SHA1
abe28bfbaa5492b62804cf2664c0aa3cecb658c9

SHA256
48699cd35f6397e24404e19d7dd49b45a278c247ec4e34b68b74515b2e3b5f9c

SHA512
94b6c5523abc41c7b7958c1a679040e375f37ada04f40dc85fe6f37188a222a4f6d12b59fa2f4bb0d0a05e6c1b6dd6fb79cc9d2670ac74714dcb52203de61100

Download Submit
memory/1044-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1044-4-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/1044-9-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download
memory/1044-10-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1312-6-0x0000000002F70000-0x0000000002F71000-memory.dmp

Filesize
4KB

Download