0d266a13cbce177d41a44cfa8ed11cd7208765dad00b3e063147356aefb79ddf

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32465ff1ab97fba1a46b64946c0044a4_JaffaCakes118.exe
Size

20KB
MD5

32465ff1ab97fba1a46b64946c0044a4
SHA1

353d41ebbbe80ce3fff2d8166808839d22d4c501
SHA256

0d266a13cbce177d41a44cfa8ed11cd7208765dad00b3e063147356aefb79ddf
SHA512

b6f0969998c997ae264a16c506b142de92ba59f7ae3119a634b88c3152fdeb6921353888d5c669b1548cc634c4009387d17ec30c49e677463e8e16c485055419
SSDEEP

384:y03rgbPpKqIn7Y3AwlYY3YzlAxfr6+e9Pfqbn114:y0bYpKq4twlL3YaxOha51

Score

7^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0008000000016c5c-7.dat	aspack_v212_v242

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\triddll = "C:\\Windows\\System32\\triddll.exe"	32465ff1ab97fba1a46b64946c0044a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\systrol = "C:\\Windows\\System32\\systrol.exe"	32465ff1ab97fba1a46b64946c0044a4_JaffaCakes118.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msexplor.exe	32465ff1ab97fba1a46b64946c0044a4_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\triddll.exe	32465ff1ab97fba1a46b64946c0044a4_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\triddll.exe	32465ff1ab97fba1a46b64946c0044a4_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\systrol.exe	32465ff1ab97fba1a46b64946c0044a4_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\systrol.exe	32465ff1ab97fba1a46b64946c0044a4_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msexplor.exe	32465ff1ab97fba1a46b64946c0044a4_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2524	32465ff1ab97fba1a46b64946c0044a4_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2524	32465ff1ab97fba1a46b64946c0044a4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\32465ff1ab97fba1a46b64946c0044a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\32465ff1ab97fba1a46b64946c0044a4_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\systrol.exe

Filesize
20KB

MD5
32465ff1ab97fba1a46b64946c0044a4

SHA1
353d41ebbbe80ce3fff2d8166808839d22d4c501

SHA256
0d266a13cbce177d41a44cfa8ed11cd7208765dad00b3e063147356aefb79ddf

SHA512
b6f0969998c997ae264a16c506b142de92ba59f7ae3119a634b88c3152fdeb6921353888d5c669b1548cc634c4009387d17ec30c49e677463e8e16c485055419

Download Submit
memory/2524-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2524-9-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2524-14-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads