ce58ac999c2a05e738066ad5c6c42da4d8061265362ed250e7808311a854c679

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe
Size

13KB
MD5

2e1ec6b9b18a42c3ec22a589f6ff1def
SHA1

f7fae61bc4b3e82f490bc10abab1972a80a6bd6e
SHA256

ce58ac999c2a05e738066ad5c6c42da4d8061265362ed250e7808311a854c679
SHA512

b54b1c19e457e4f25492a45ece7a5106454aabb04c37735c27a6797e56a3ac04905d9c4ab053af8385c96ed0b0b499db38a38b3875217f332253d716cd91a890
SSDEEP

384:7GMSWWZTi+fjPjTRKJIitq892OaC0CIQ:qBW+fHT4J3q89n0C

Score

8^/10

persistence privilege_escalation upx

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Deletes itself 1 IoCs

pid	Process
2708	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2860	insersek.exe

Loads dropped DLL 2 IoCs

pid	Process
2624	2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe
2624	2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2624-1-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/files/0x00070000000186e9-9.dat	upx
behavioral1/memory/2860-12-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/2624-13-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/2860-14-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\inserse.dll	2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\insersek.exe	2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\insersek.exe	2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2860	2624	2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe	31
PID 2624 wrote to memory of 2860	2624	2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe	31
PID 2624 wrote to memory of 2860	2624	2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe	31
PID 2624 wrote to memory of 2860	2624	2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe	31
PID 2624 wrote to memory of 2708	2624	2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe	32
PID 2624 wrote to memory of 2708	2624	2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe	32
PID 2624 wrote to memory of 2708	2624	2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe	32
PID 2624 wrote to memory of 2708	2624	2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\insersek.exe
  C:\Windows\system32\insersek.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe.bat
  2⤵
  - Deletes itself
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2e1ec6b9b18a42c3ec22a589f6ff1def_JaffaCakes118.exe.bat

Filesize
210B

MD5
f54f68dac095caa201f188691fb76415

SHA1
6f2fb5e4fca552f7a55d5b19aadb0f35a0d5bf3b

SHA256
903d7e462d3252aa3b16f0687a67c33749261aae248ca9c3c4e54043088dbeaa

SHA512
62934611364087847e079488248e7ac6fc36876c586497b11f80ab4135ebfb802793d9b627dea967b671f99bd7e4f5296b043d239d4233b827a3e13521e37ee1

Download Submit
C:\Windows\SysWOW64\insersek.exe

Filesize
13KB

MD5
2e1ec6b9b18a42c3ec22a589f6ff1def

SHA1
f7fae61bc4b3e82f490bc10abab1972a80a6bd6e

SHA256
ce58ac999c2a05e738066ad5c6c42da4d8061265362ed250e7808311a854c679

SHA512
b54b1c19e457e4f25492a45ece7a5106454aabb04c37735c27a6797e56a3ac04905d9c4ab053af8385c96ed0b0b499db38a38b3875217f332253d716cd91a890

Download Submit
memory/2624-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2624-11-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2624-10-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2624-13-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2624-18-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2624-17-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2860-12-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2860-14-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download