7245e837f4b16641572f0fc08f31e38d8f3dfbdd0b8c31838bd43860c3025486

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe
Size

172KB
MD5

152f400a9c3a3c345fa98739b5689bc7
SHA1

1bf8356095f469f370da45fb6adba968a917db1b
SHA256

7245e837f4b16641572f0fc08f31e38d8f3dfbdd0b8c31838bd43860c3025486
SHA512

f72a4093846fb9f45cb9a904e70c5bc17c5ead787e908972033abb7af3c31035fc0f465073cf1d0fb58a6d2753d9fc7b9af65e19ca6255e3a9e37fb3ef4c945e
SSDEEP

3072:R9BMlLI9acXMLkVqqYDFtHiMDtT9CqRf8wSt9t0Fv8jlPlTLC92j91:3SNI9H8LaqjCO/dfEju8j1pC+H

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2776-4-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2776-2-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2776-81-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2776-12-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2776-11-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2776-10-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2776-8-0x0000000000400000-0x0000000000441000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1312 set thread context of 2776	1312	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe
2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe
Token: SeDebugPrivilege	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2776	1312	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	28
PID 1312 wrote to memory of 2776	1312	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	28
PID 1312 wrote to memory of 2776	1312	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	28
PID 1312 wrote to memory of 2776	1312	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	28
PID 1312 wrote to memory of 2776	1312	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	28
PID 1312 wrote to memory of 2776	1312	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	28
PID 1312 wrote to memory of 2776	1312	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	28
PID 1312 wrote to memory of 2776	1312	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	28
PID 2776 wrote to memory of 1212	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	21
PID 2776 wrote to memory of 384	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	3
PID 2776 wrote to memory of 432	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	5
PID 2776 wrote to memory of 492	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	7
PID 2776 wrote to memory of 500	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	8
PID 2776 wrote to memory of 612	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	9
PID 2776 wrote to memory of 688	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	10
PID 2776 wrote to memory of 764	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	11
PID 2776 wrote to memory of 824	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	12
PID 2776 wrote to memory of 860	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	13
PID 2776 wrote to memory of 980	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	15
PID 2776 wrote to memory of 276	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	16
PID 2776 wrote to memory of 708	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	17
PID 2776 wrote to memory of 1076	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	18
PID 2776 wrote to memory of 1120	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	19
PID 2776 wrote to memory of 1184	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	20
PID 2776 wrote to memory of 1212	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	21
PID 2776 wrote to memory of 1064	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	23
PID 2776 wrote to memory of 2984	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	24
PID 2776 wrote to memory of 2948	2776	152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe	25

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:612
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:824
- C:\Windows\system32\Dwm.exe
  "C:\Windows\system32\Dwm.exe"
  2⤵
  PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:276

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1076

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Users\Admin\AppData\Local\Temp\152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\152f400a9c3a3c345fa98739b5689bc7_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:2984

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:2948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-62-0x000000000EA80000-0x000000000EAC3000-memory.dmp

Filesize
268KB

Download
memory/2776-4-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2776-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2776-2-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2776-82-0x000000000041A000-0x0000000000440000-memory.dmp

Filesize
152KB

Download
memory/2776-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2776-12-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2776-11-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2776-10-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2776-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2776-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download