cdd7e62c0346cfb1d56026da1f3fcb0a401908d0cc74561c543b98e0fdce8d51

Analysis

max time kernel
137s
max time network
138s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

26cfdde81e05d05acd41d6fb3a653dc9_JaffaCakes118.exe
Size

216KB
MD5

26cfdde81e05d05acd41d6fb3a653dc9
SHA1

329f18f04802d7529c3e228ad43a177a55a9968d
SHA256

cdd7e62c0346cfb1d56026da1f3fcb0a401908d0cc74561c543b98e0fdce8d51
SHA512

d213c63c7d607114e8cdcb523add90c5fc59164d3f8b8c88838a730c8f67fc84a342167a9f1fe2415a61dac8af70d0bac200e92a62facabc1fc4ad237f1002b7
SSDEEP

6144:csYzVCyuasshciAURsqqRGU7Wu4I0Z/xb:csGCygsCURsqqL30Z/l

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2068	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2236-0-0x0000000000400000-0x000000000044B000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2236 set thread context of 2068	2236	26cfdde81e05d05acd41d6fb3a653dc9_JaffaCakes118.exe	28

Modifies registry class 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5a547949-c794-517c-4544-12494bea66d5}\cid = "7731816460791346112"	explorer.exe
Key created	\registry\machine\Software\Classes\Interface\{5a547949-c794-517c-4544-12494bea66d5}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5a547949-c794-517c-4544-12494bea66d5}\u = "170"	explorer.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	explorer.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2068	2236	26cfdde81e05d05acd41d6fb3a653dc9_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2068	2236	26cfdde81e05d05acd41d6fb3a653dc9_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2068	2236	26cfdde81e05d05acd41d6fb3a653dc9_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2068	2236	26cfdde81e05d05acd41d6fb3a653dc9_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2068	2236	26cfdde81e05d05acd41d6fb3a653dc9_JaffaCakes118.exe	28
PID 2068 wrote to memory of 332	2068	explorer.exe	2
PID 332 wrote to memory of 2756	332	csrss.exe	29
PID 332 wrote to memory of 2756	332	csrss.exe	29
PID 332 wrote to memory of 2540	332	csrss.exe	30
PID 332 wrote to memory of 2540	332	csrss.exe	30

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Users\Admin\AppData\Local\Temp\26cfdde81e05d05acd41d6fb3a653dc9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26cfdde81e05d05acd41d6fb3a653dc9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\explorer.exe
  00000060*
  2⤵
  - Deletes itself
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2068

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2756

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.DLL

Filesize
31KB

MD5
dafc4a53954b76c5db1d857e955f3805

SHA1
a18fa0d38c6656b4398953e77e87eec3b0209ef3

SHA256
c6c82dde145a2dd9d70b1b539b17571befb663fc4a9ca834ff2a140cc4ebaa0b

SHA512
745e27a4f952e2492dbd12ced396be2c7dc78344ba415ad64b45920f95d7a282e30c7ad2da9266dc195c71e38019809e8183a705f9276c7d178de2f5ef34b633

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
76502f66b75ba416fee4024ef0da9118

SHA1
96704a4a102228bbac7cb044a6832117b3541867

SHA256
624111d1718b3c44e43419142e963912a8848166e14e3ee651085f187d98a296

SHA512
4996dce97c70982a362154b10e442b85b9bd996c93701f70418ebef7c279dc359e6367f155e20cf2d61747252728f6027d9e087e080c88b218fb9b934f50add2

Download Submit
memory/332-20-0x0000000000E00000-0x0000000000E0C000-memory.dmp

Filesize
48KB

Download
memory/332-21-0x0000000000E00000-0x0000000000E0C000-memory.dmp

Filesize
48KB

Download
memory/2068-4-0x0000000000140000-0x0000000000154000-memory.dmp

Filesize
80KB

Download
memory/2068-15-0x0000000000060000-0x0000000000072000-memory.dmp

Filesize
72KB

Download
memory/2068-14-0x0000000000140000-0x0000000000154000-memory.dmp

Filesize
80KB

Download
memory/2068-9-0x0000000000140000-0x0000000000154000-memory.dmp

Filesize
80KB

Download
memory/2236-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2236-1-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/2236-3-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download