ba83afde097acfbcf72a83c12fd8c58639ddf165ab0134f194e70549b1cdf891

Analysis

max time kernel
149s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe
Size

390KB
MD5

177eb68cc4f405e5a89c4a0867b738fb
SHA1

fa0daae7e6db8a56aca0d9bcd0e9673b45946186
SHA256

ba83afde097acfbcf72a83c12fd8c58639ddf165ab0134f194e70549b1cdf891
SHA512

f27297df6c8cd4dc587461623e1faa34dc183162d3b5681c25d7ccd650fd46bdd64f512e4537acb01cbb01c3fc72fa1e2692bf8f55e5fbf39775da89068310d7
SSDEEP

3072:1oWoaYMS7k7YS+OZVsrKmrBAf7qcbPmNfq/b3hDHAwE4aJaMkynQssssssDssssY:1O6wOZVYWD7PmRq/Bw55

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2660	service.exe
2796	service.exe
2608	service.exe

Loads dropped DLL 5 IoCs

pid	Process
1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe
1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe
1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe
1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe
1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2796-41-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/2796-42-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/2796-38-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/2796-62-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\""	service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\""	service.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2660 set thread context of 2796	2660	service.exe	32
PID 2796 set thread context of 2608	2796	service.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2608	service.exe
2608	service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe
2660	service.exe
2796	service.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2968	1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2968	1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2968	1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2968	1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe	28
PID 2968 wrote to memory of 2268	2968	cmd.exe	30
PID 2968 wrote to memory of 2268	2968	cmd.exe	30
PID 2968 wrote to memory of 2268	2968	cmd.exe	30
PID 2968 wrote to memory of 2268	2968	cmd.exe	30
PID 1932 wrote to memory of 2660	1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe	31
PID 1932 wrote to memory of 2660	1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe	31
PID 1932 wrote to memory of 2660	1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe	31
PID 1932 wrote to memory of 2660	1932	177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe	31
PID 2660 wrote to memory of 2796	2660	service.exe	32
PID 2660 wrote to memory of 2796	2660	service.exe	32
PID 2660 wrote to memory of 2796	2660	service.exe	32
PID 2660 wrote to memory of 2796	2660	service.exe	32
PID 2660 wrote to memory of 2796	2660	service.exe	32
PID 2660 wrote to memory of 2796	2660	service.exe	32
PID 2660 wrote to memory of 2796	2660	service.exe	32
PID 2660 wrote to memory of 2796	2660	service.exe	32
PID 2660 wrote to memory of 2796	2660	service.exe	32
PID 2796 wrote to memory of 2608	2796	service.exe	33
PID 2796 wrote to memory of 2608	2796	service.exe	33
PID 2796 wrote to memory of 2608	2796	service.exe	33
PID 2796 wrote to memory of 2608	2796	service.exe	33
PID 2796 wrote to memory of 2608	2796	service.exe	33
PID 2796 wrote to memory of 2608	2796	service.exe	33
PID 2796 wrote to memory of 2608	2796	service.exe	33
PID 2796 wrote to memory of 2608	2796	service.exe	33
PID 2796 wrote to memory of 2608	2796	service.exe	33
PID 2796 wrote to memory of 2608	2796	service.exe	33
PID 2608 wrote to memory of 1196	2608	service.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\177eb68cc4f405e5a89c4a0867b738fb_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\259402222.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\service.exe" /f
      4⤵
      Adds Run key to start application
      PID:2268
- - C:\Users\Admin\AppData\Roaming\Microsoft\service.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\service.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Roaming\Microsoft\service.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\service.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2796
    - - C:\Users\Admin\AppData\Roaming\Microsoft\service.exe
        
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259402222.bat

Filesize
146B

MD5
7eee65b102f30fd1ead48a8cd3b99827

SHA1
2f74a754019f280c6186c11531d460006814952e

SHA256
5748c60056db288b67e61148b339778816279e36907977f4fe03b5df04f6b57f

SHA512
a06de9e35ada579a95b2ba399e4c65b074d642788d456e10e0ae967896ac729c552f715261d9dc8c17fffca8d6b9144a6155ff11ab8569a82bdbd9d26109bd85

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\service.exe

Filesize
390KB

MD5
1fcf9e0a07bca953372b2b6e23a916e1

SHA1
64bef037a77c13f7146ce297b5716a573cf6206b

SHA256
ce99ebeab8fdd9d0258bda074206014e29f6233d4309b7c6b835a47db8798be2

SHA512
13cdaa6e9ef3ba2b0871dda52191f4c58753b263d88d3466ea5906a67af986b58a7e37a8a898138ca7f994d9d0ded805c0846a05da582e982d0585c63677fb01

Download Submit
memory/2608-47-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2608-49-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2608-72-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2608-45-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2608-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2608-63-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2608-57-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2608-53-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2608-51-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2608-69-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2608-71-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2608-70-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2608-64-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2796-62-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2796-41-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2796-42-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2796-38-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download