ce46a492a3abc1faab1e4a6e3ae430b8c68b858cba204d7a86f16bba19683661

Analysis

max time kernel
147s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe
Size

74KB
MD5

189851836e7c3c836a36cbd4e5d00dce
SHA1

e1ceb793467c8fb1442a3e3a581c4151275559dd
SHA256

ce46a492a3abc1faab1e4a6e3ae430b8c68b858cba204d7a86f16bba19683661
SHA512

b7caeb94c2a7e6cba9073ced87de0ad425dd0a212af5b2698ed8c2958b5be51596d514d875eb227fb6c9f3503a0ed916fa3926cbd4a2587ebb5eb6af911d9e89
SSDEEP

1536:t0JUpReIXnb72L31MPuH/i9cPdbZdDc7rqUDJxjayej6mQ9:txSI3/2Dfq9cPdIDJxGyH9

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2096	rundl32.exe
2660	rundl32.exe
2588	rundll32.exe

Loads dropped DLL 9 IoCs

pid	Process
2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe
2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe
2096	rundl32.exe
2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe
2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe
2752	WerFault.exe
2752	WerFault.exe
2752	WerFault.exe
2752	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rundll32.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32.exe"	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2096 set thread context of 2660	2096	rundl32.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2588	WerFault.exe	33

Runs net.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2192	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	28
PID 2348 wrote to memory of 2192	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	28
PID 2348 wrote to memory of 2192	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	28
PID 2348 wrote to memory of 2192	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	28
PID 2192 wrote to memory of 2984	2192	net.exe	30
PID 2192 wrote to memory of 2984	2192	net.exe	30
PID 2192 wrote to memory of 2984	2192	net.exe	30
PID 2192 wrote to memory of 2984	2192	net.exe	30
PID 2348 wrote to memory of 2096	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2096	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2096	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2096	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	31
PID 2096 wrote to memory of 2660	2096	rundl32.exe	32
PID 2096 wrote to memory of 2660	2096	rundl32.exe	32
PID 2096 wrote to memory of 2660	2096	rundl32.exe	32
PID 2096 wrote to memory of 2660	2096	rundl32.exe	32
PID 2096 wrote to memory of 2660	2096	rundl32.exe	32
PID 2096 wrote to memory of 2660	2096	rundl32.exe	32
PID 2096 wrote to memory of 2660	2096	rundl32.exe	32
PID 2096 wrote to memory of 2660	2096	rundl32.exe	32
PID 2348 wrote to memory of 2588	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	33
PID 2348 wrote to memory of 2588	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	33
PID 2348 wrote to memory of 2588	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	33
PID 2348 wrote to memory of 2588	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	33
PID 2348 wrote to memory of 2588	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	33
PID 2348 wrote to memory of 2588	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	33
PID 2348 wrote to memory of 2588	2348	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	33
PID 2588 wrote to memory of 2752	2588	rundll32.exe	34
PID 2588 wrote to memory of 2752	2588	rundll32.exe	34
PID 2588 wrote to memory of 2752	2588	rundll32.exe	34
PID 2588 wrote to memory of 2752	2588	rundll32.exe	34

C:\Users\Admin\AppData\Local\Temp\189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2348
- C:\windows\SysWOW64\net.exe
  "C:\windows\system32\net.exe" stop wscsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop wscsvc
    3⤵
    PID:2984
- C:\Users\Admin\AppData\Local\Temp\rundl32.exe
  "C:\Users\Admin\AppData\Local\Temp\rundl32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Users\Admin\AppData\Local\Temp\rundl32.exe
    "C:\Users\Admin\AppData\Local\Temp\rundl32.exe"
    3⤵
    - Executes dropped EXE
    PID:2660
- C:\Users\Admin\AppData\Local\Temp\rundll32.exe
  "C:\Users\Admin\AppData\Local\Temp\rundll32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 196
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rundl32.exe

Filesize
22KB

MD5
9b317cf75128dae3257f5c9988092953

SHA1
546565818b33ba4037daf36f86a892deefa719a6

SHA256
6e84427e3d38c26da42eb64c209ec615caa7f62d73b0bda9f2c9ab530513221d

SHA512
0c7d3a6c3e679797cc2cb5e15c634544c6c9dccd9c1772a8227a9895a6b09759fe6c373767f082f2b7e21f5a619cda07078011697040ca6c3cf4b4ce19f5d0c8

Download Submit
\Users\Admin\AppData\Local\Temp\rundll32.exe

Filesize
36KB

MD5
fe7285a11b8ef5158383b3fcc3a63fb1

SHA1
f3aacd6ae45e24c593883a1109dd6fcb6ac8e7a6

SHA256
c9a2ee86e317978b235483bbf55b3b1c4b9aa2a4ed127a1f73ccc72e06ba17ae

SHA512
4ad5832042bbcbf8a35522d9f871338a6d5341d9f2cea5cbb5f0b67d48defa05dd80d5353bc6395e84e52d759c144cddde48bc411c4fb25f44bbb87c99fd1628

Download Submit
memory/2096-10-0x0000000000100000-0x0000000000108000-memory.dmp

Filesize
32KB

Download
memory/2096-22-0x0000000000100000-0x0000000000108000-memory.dmp

Filesize
32KB

Download
memory/2348-4-0x0000000000490000-0x0000000000498000-memory.dmp

Filesize
32KB

Download
memory/2588-37-0x0000000000100000-0x000000000010B000-memory.dmp

Filesize
44KB

Download
memory/2660-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2660-17-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download
memory/2660-15-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download
memory/2660-14-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download
memory/2660-13-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads