f1d40a3b632221d10c3fa18ae47edf78c9b18abf6b2ed94eba0a8c59441d8024

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
Size

74KB
MD5

21d27cfd178c79ac7b8be09a5d764e00
SHA1

797b0b2485754d1de6503e488403b40eb58f769e
SHA256

f1d40a3b632221d10c3fa18ae47edf78c9b18abf6b2ed94eba0a8c59441d8024
SHA512

4098b53e93393c3a4c237c65d093cf12fffd450873223af4e8a214a206ec932413689567dbf2ddd6a8b4a4745f76759d92599227ccd893a4c434e3ea5367f92d
SSDEEP

1536:zUoMXxBw5oWynBr69ZMRsHSuZ2ASpibyC00kkz/mzJXjkETIIru:YpXxBwMBr6LMRsHfZ2ASpn5zZkcu

Score

7^/10

persistence upx

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2480-1-0x0000000000020000-0x0000000000040000-memory.dmp	upx
behavioral1/memory/2480-3-0x0000000000020000-0x0000000000040000-memory.dmp	upx
behavioral1/memory/2480-5-0x0000000000020000-0x0000000000040000-memory.dmp	upx
behavioral1/memory/2960-20-0x0000000000020000-0x0000000000040000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\kava = "C:\\Windows\\system32\\kavo.exe"	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kavo0.dll	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\kavo.exe	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\kavo.exe	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\kavo0.dll	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2708	2960	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
Token: SeDebugPrivilege	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
Token: SeDebugPrivilege	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2976	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2976	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2976	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2976	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2976	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2976	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2976	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2976	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2976	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2960	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	29
PID 2480 wrote to memory of 2960	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	29
PID 2480 wrote to memory of 2960	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	29
PID 2480 wrote to memory of 2960	2480	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	29
PID 2960 wrote to memory of 2696	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	30
PID 2960 wrote to memory of 2696	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	30
PID 2960 wrote to memory of 2696	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	30
PID 2960 wrote to memory of 2696	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	30
PID 2960 wrote to memory of 2700	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	31
PID 2960 wrote to memory of 2700	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	31
PID 2960 wrote to memory of 2700	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	31
PID 2960 wrote to memory of 2700	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	31
PID 2960 wrote to memory of 2700	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	31
PID 2960 wrote to memory of 2700	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	31
PID 2960 wrote to memory of 2700	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	31
PID 2960 wrote to memory of 2700	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	31
PID 2960 wrote to memory of 2700	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	31
PID 2960 wrote to memory of 1392	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	21
PID 2960 wrote to memory of 2708	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	32
PID 2960 wrote to memory of 2708	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	32
PID 2960 wrote to memory of 2708	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	32
PID 2960 wrote to memory of 2708	2960	21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1392
- C:\Users\Admin\AppData\Local\Temp\21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2976
- - C:\Users\Admin\AppData\Local\Temp\21d27cfd178c79ac7b8be09a5d764e00_JaffaCakes118.exe
    _KAV888VAK_
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2696
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 288
      4⤵
      Program crash
      PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\bgymgfnz.dll

Filesize
30KB

MD5
582fbf575e9cc86e3fdbcc09ea5da264

SHA1
2ebedccfce6ec73947944b54caaf430222e6597d

SHA256
0e335b055961bc84e6f1fe5f05eabaae0b0b573a9aca36e2b04c6e2bbf4b8a9e

SHA512
59eca7e6e6bba8c456cca4c21817e303b74f487c43f8c34f94936aec0342f1b23bb7fe808294b45bbd88d78d60295f286d8e833b975472b4ffbe473b3cc81836

Download Submit
\Windows\SysWOW64\kavo0.dll

Filesize
36KB

MD5
32aac0ecbd7f93814c2a62bff1c9ce55

SHA1
0b68cdcee1c8483a04df22387d0d2ba0902cad57

SHA256
6154482bb8b6d4d034c50189817b62e98ebf41236f0d0d70b629712a62f6e4cd

SHA512
c933a7eaca2012c7bb375cd2993692276abc8f348abe6fc213028c7b688813c781291f58efc3ea2656a027750932eca1b622cf2656419cf39fef0ffd4b481a4e

Download Submit
memory/1392-24-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/2480-4-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2480-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2480-5-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/2480-11-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2480-10-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2480-3-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/2480-1-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/2480-2-0x000000000041A000-0x000000000041B000-memory.dmp

Filesize
4KB

Download
memory/2960-20-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/2960-22-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2960-16-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2960-17-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2960-27-0x0000000000240000-0x000000000024F000-memory.dmp

Filesize
60KB

Download
memory/2960-29-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download