d2c32b4cea85d303cfc8793bb331372fa2ead29bc57e19dd702bf06f0a28f938

Analysis

max time kernel
150s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

313abf1b03ce34ae416eb583570ecfdb_JaffaCakes118.exe
Size

116KB
MD5

313abf1b03ce34ae416eb583570ecfdb
SHA1

5d56a2d723bb9288c6ea657008014004b4b081b4
SHA256

d2c32b4cea85d303cfc8793bb331372fa2ead29bc57e19dd702bf06f0a28f938
SHA512

2e05ec3c4b6a0e1326051611a14694630cdec311d4400354ae549d5abbed5bb25bdb75957f4723723cce712ebd4abc04e7ec158c13138b8c2e0c752e030f7206
SSDEEP

3072:98RTVXDNJqxSA5HDc3I3nNoOsRXurRUQzj+5T/U:SZRcx5VMpOKXur2Qf+5T

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2368	Vryvea.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	313abf1b03ce34ae416eb583570ecfdb_JaffaCakes118.exe
File opened for modification	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	313abf1b03ce34ae416eb583570ecfdb_JaffaCakes118.exe
File created	C:\Windows\Vryvea.exe	313abf1b03ce34ae416eb583570ecfdb_JaffaCakes118.exe
File opened for modification	C:\Windows\Vryvea.exe	313abf1b03ce34ae416eb583570ecfdb_JaffaCakes118.exe
File created	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	Vryvea.exe
File opened for modification	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	Vryvea.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	Vryvea.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International	Vryvea.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe
2368	Vryvea.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2368	2792	313abf1b03ce34ae416eb583570ecfdb_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2368	2792	313abf1b03ce34ae416eb583570ecfdb_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2368	2792	313abf1b03ce34ae416eb583570ecfdb_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2368	2792	313abf1b03ce34ae416eb583570ecfdb_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\313abf1b03ce34ae416eb583570ecfdb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\313abf1b03ce34ae416eb583570ecfdb_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\Vryvea.exe
  C:\Windows\Vryvea.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Twain001.Mtx

Filesize
2B

MD5
309fc7d3bc53bb63ac42e359260ac740

SHA1
2064f80f811db79a33c4e51c10221454e30c74ae

SHA256
ac11339ffa8f270c4f781e0a3922bb1c80d9dee6e4b6911ca34538ed9ae03caa

SHA512
77dd27d30f4e13a0bcd6fd27ae7567c136d87393e5ee632bccf05b0a0d2bbcc2fc0fd777a8508e26cc4fc579c8da0ab56b7bf179b1adc70f28f7d0eee89fa5f8

Download Submit
C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

Filesize
372B

MD5
9142a6017a04c174ed240bbf63a1463e

SHA1
54c7ac8b2ac1daa9c8b8068ad96d6deb441ae432

SHA256
4748d3fa766ff33d095f59b19d8f81be0e7bc3d8703f48bb649cb442694ef1d4

SHA512
bafad369346744f128a130f45ab8a41cdae374bdb1b595fcde64abb9eeadb804bed4cae17f715b2f218428bcfe93c49adbbbc95526660ead62ca81a8d78bcd06

Download Submit
C:\Windows\Vryvea.exe

Filesize
116KB

MD5
313abf1b03ce34ae416eb583570ecfdb

SHA1
5d56a2d723bb9288c6ea657008014004b4b081b4

SHA256
d2c32b4cea85d303cfc8793bb331372fa2ead29bc57e19dd702bf06f0a28f938

SHA512
2e05ec3c4b6a0e1326051611a14694630cdec311d4400354ae549d5abbed5bb25bdb75957f4723723cce712ebd4abc04e7ec158c13138b8c2e0c752e030f7206

Download Submit
memory/2368-46141-0x0000000075300000-0x000000007530F000-memory.dmp

Filesize
60KB

Download
memory/2368-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-46140-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-46144-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-46146-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-46148-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-46151-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-46153-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-46161-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2792-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2792-46139-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2792-46138-0x0000000075300000-0x000000007530F000-memory.dmp

Filesize
60KB

Download
memory/2792-1-0x0000000000350000-0x0000000000373000-memory.dmp

Filesize
140KB

Download