b901e3801f1bb4b156041e191da4adb995e69c0aebe86ce8349b7c7f2d9427d7

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe
Size

244KB
MD5

1a83097ddec868cc4872ea3f2df9b76a
SHA1

2a8820a7d401d76446398fcc6fed916b2585d364
SHA256

b901e3801f1bb4b156041e191da4adb995e69c0aebe86ce8349b7c7f2d9427d7
SHA512

274972b43e35fb5edbe58c33f5c879b8cacc54a59e54eeec3785b72f69c7ded158c6e4fcef7d792dbcee88f6a64ce096dca044801e3d3254a589c2735d9c491d
SSDEEP

3072:OcQiSBOePHDkUe0mVZLTYNAUnSptxldQIaevadbRS/LKfuEaLeYbnfLk8GuhSi:vQ1b5elZLFUSLsevadF+KfhzY5b

Score

8^/10

persistence upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\npf.sys	1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
2484	1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe
2484	1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2484-2-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral1/memory/2484-4-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral1/memory/2484-6-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral1/memory/2484-11-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral1/memory/2484-19-0x0000000000400000-0x000000000049A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sniffer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe"	1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Packet.dll	1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wpcap.dll	1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	2484	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2484	1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2612	2484	1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2612	2484	1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2612	2484	1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2612	2484	1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a83097ddec868cc4872ea3f2df9b76a_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 104
  2⤵
  - Program crash
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\Packet.dll

Filesize
98KB

MD5
b4d3cbc053e70143d350d6107b94952c

SHA1
5ebdb0ef1f00a1024637adf106d7b2a9b43bbcda

SHA256
2198fd8cd738d6281c8c1fc4845effd251b3d6b7f83b9f4f927d6430cf12537b

SHA512
539244352ffc0ca6e08bba2704abd1286873375dad28421862bd9ce7a8146d9472dc5e4ac3edb59ae741f5b178cd22f976fbba62a0bc71c09160e1c9f178e523

Download Submit
\Windows\SysWOW64\wpcap.dll

Filesize
274KB

MD5
dae5f233818083af69e2e5133a50a2cb

SHA1
18a2672972a9440f51b3d416a933b20b8ae6252a

SHA256
b0ce20a14e8cef5a94e2ef057e5685eac3636c6b71166b4f99af31c3422c4121

SHA512
ca71f6b0c2c1f5c00eda9af97b4426c9ca386785c5f0d712dc971ddf0b13e1a0e7ef691932b61c5fda009df2da8422df09ffaf5061aa0b674a98dcc57caa405a

Download Submit
memory/2484-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2484-2-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2484-4-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2484-10-0x0000000000460000-0x0000000000493000-memory.dmp

Filesize
204KB

Download
memory/2484-6-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2484-11-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2484-16-0x0000000000380000-0x0000000000399000-memory.dmp

Filesize
100KB

Download
memory/2484-19-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2484-21-0x0000000000460000-0x0000000000493000-memory.dmp

Filesize
204KB

Download