d72155b95d4a53a3399044273b68ac273b708ab360b8bbeb2a44a9bcc6a3bd05

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe
Size

14KB
MD5

24147881c3d393d0a8c7c8c62668e88c
SHA1

bc724981cab03f87518b566afb786a596361f276
SHA256

d72155b95d4a53a3399044273b68ac273b708ab360b8bbeb2a44a9bcc6a3bd05
SHA512

9ab5c435f275b1ae2f6fcc6d68ab8eefe1f8cb0456c75a05f9d30b1a2a81f1fd20e92fb7ea5c97f883961ed41d6781f5ae45a29a4575760f5dd301c50eadc021
SSDEEP

384:UcQIjE5EpcvLfhc5waHf3zNZGtIUE7q1mozuOsf3:UsrpcDiqavR0Cq1ZVsP

Score

8^/10

persistence privilege_escalation upx

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Deletes itself 1 IoCs

pid	Process
2960	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2192	micsusk.exe

Loads dropped DLL 2 IoCs

pid	Process
2020	24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe
2020	24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2020-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/files/0x004b00000001430e-3.dat	upx
behavioral1/memory/2192-11-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/2020-10-0x0000000000230000-0x000000000023F000-memory.dmp	upx
behavioral1/memory/2020-12-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\micsus.dll	24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\micsusk.exe	24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\micsusk.exe	24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2192	2020	24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe	28
PID 2020 wrote to memory of 2192	2020	24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe	28
PID 2020 wrote to memory of 2192	2020	24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe	28
PID 2020 wrote to memory of 2192	2020	24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe	28
PID 2020 wrote to memory of 2960	2020	24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2960	2020	24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2960	2020	24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2960	2020	24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\micsusk.exe
  C:\Windows\system32\micsusk.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe.bat
  2⤵
  - Deletes itself
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\24147881c3d393d0a8c7c8c62668e88c_JaffaCakes118.exe.bat

Filesize
210B

MD5
4fcee714cfa768e2ceb56b446e066597

SHA1
b862fdc19a7ae2609a6472eecf8d5d4978b5d679

SHA256
d2d5cd817a4ea2df68b9852c717f2c79abc8d1b8e8af1d4845f4f4393b89389d

SHA512
22b28e1f28e6bf4f2dad04ee5d4a5c3fdb026ed6351bbdbe36e883329b9b3f5d3e2e189ea6063cf98d3730378e46eef3f251335096847e21183f751807749150

Download Submit
\Windows\SysWOW64\micsusk.exe

Filesize
14KB

MD5
24147881c3d393d0a8c7c8c62668e88c

SHA1
bc724981cab03f87518b566afb786a596361f276

SHA256
d72155b95d4a53a3399044273b68ac273b708ab360b8bbeb2a44a9bcc6a3bd05

SHA512
9ab5c435f275b1ae2f6fcc6d68ab8eefe1f8cb0456c75a05f9d30b1a2a81f1fd20e92fb7ea5c97f883961ed41d6781f5ae45a29a4575760f5dd301c50eadc021

Download Submit
memory/2020-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2020-10-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2020-12-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2020-16-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2192-11-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download