574ee54d313b22dd0a96997415cc7d7c68050c7adf8f25ddb292b02437fe74a9

Analysis

max time kernel
141s
max time network
81s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe
Size

194KB
MD5

38ea5ac4d7bf5b538c9adfb4d440d80c
SHA1

0119c634455b42a6cef843ec92ca9f83ca099177
SHA256

574ee54d313b22dd0a96997415cc7d7c68050c7adf8f25ddb292b02437fe74a9
SHA512

614a90866944ba06b444ba6a84be4ec8047065a16f1883120ebc73d2610628b9d64d9bb761ff41ac3856291d963388311ff2a3da9ade6a95ad9976d04fde82c0
SSDEEP

3072:aeDPxjFjuGTlscyR07UVtIdcCFiRZst0EuH8kvs0RRUXjk+G:akPpV3TlLWtI1iIt0Euc50RaXQ

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2104	Update.exe

Loads dropped DLL 8 IoCs

pid	Process
2064	38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe
2104	Update.exe
2104	Update.exe
2104	Update.exe
2756	WerFault.exe
2756	WerFault.exe
2756	WerFault.exe
2756	WerFault.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2064-0-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral1/files/0x0006000000018bac-3.dat	upx
behavioral1/memory/2064-5-0x0000000001E70000-0x0000000001EF7000-memory.dmp	upx
behavioral1/memory/2064-8-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral1/memory/2104-11-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral1/memory/2104-21-0x0000000000400000-0x0000000000487000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2104	WerFault.exe	31

Runs net.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2524	2064	38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe	29
PID 2064 wrote to memory of 2524	2064	38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe	29
PID 2064 wrote to memory of 2524	2064	38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe	29
PID 2064 wrote to memory of 2524	2064	38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe	29
PID 2064 wrote to memory of 2104	2064	38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2104	2064	38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2104	2064	38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2104	2064	38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2104	2064	38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2104	2064	38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2104	2064	38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe	31
PID 2524 wrote to memory of 1716	2524	net.exe	32
PID 2524 wrote to memory of 1716	2524	net.exe	32
PID 2524 wrote to memory of 1716	2524	net.exe	32
PID 2524 wrote to memory of 1716	2524	net.exe	32
PID 2104 wrote to memory of 2412	2104	Update.exe	33
PID 2104 wrote to memory of 2412	2104	Update.exe	33
PID 2104 wrote to memory of 2412	2104	Update.exe	33
PID 2104 wrote to memory of 2412	2104	Update.exe	33
PID 2104 wrote to memory of 2412	2104	Update.exe	33
PID 2104 wrote to memory of 2412	2104	Update.exe	33
PID 2104 wrote to memory of 2412	2104	Update.exe	33
PID 2412 wrote to memory of 1196	2412	net.exe	35
PID 2412 wrote to memory of 1196	2412	net.exe	35
PID 2412 wrote to memory of 1196	2412	net.exe	35
PID 2412 wrote to memory of 1196	2412	net.exe	35
PID 2412 wrote to memory of 1196	2412	net.exe	35
PID 2412 wrote to memory of 1196	2412	net.exe	35
PID 2412 wrote to memory of 1196	2412	net.exe	35
PID 2104 wrote to memory of 2756	2104	Update.exe	36
PID 2104 wrote to memory of 2756	2104	Update.exe	36
PID 2104 wrote to memory of 2756	2104	Update.exe	36
PID 2104 wrote to memory of 2756	2104	Update.exe	36
PID 2104 wrote to memory of 2756	2104	Update.exe	36
PID 2104 wrote to memory of 2756	2104	Update.exe	36
PID 2104 wrote to memory of 2756	2104	Update.exe	36

C:\Users\Admin\AppData\Local\Temp\38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\38ea5ac4d7bf5b538c9adfb4d440d80c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\net.exe
  net stop SharedAccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SharedAccess
    3⤵
    PID:1716
- C:\Arquivos de programas\WindowsUpdate\Update.exe
  "C:\Arquivos de programas\WindowsUpdate\Update.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      PID:1196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 560
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Arquivos de Programas\WindowsUpdate\Update.exe

Filesize
194KB

MD5
38ea5ac4d7bf5b538c9adfb4d440d80c

SHA1
0119c634455b42a6cef843ec92ca9f83ca099177

SHA256
574ee54d313b22dd0a96997415cc7d7c68050c7adf8f25ddb292b02437fe74a9

SHA512
614a90866944ba06b444ba6a84be4ec8047065a16f1883120ebc73d2610628b9d64d9bb761ff41ac3856291d963388311ff2a3da9ade6a95ad9976d04fde82c0

Download Submit
memory/2064-0-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2064-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2064-5-0x0000000001E70000-0x0000000001EF7000-memory.dmp

Filesize
540KB

Download
memory/2064-8-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2104-11-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2104-15-0x0000000000300000-0x0000000000387000-memory.dmp

Filesize
540KB

Download
memory/2104-16-0x0000000000300000-0x0000000000387000-memory.dmp

Filesize
540KB

Download
memory/2104-21-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2104-23-0x0000000000300000-0x0000000000387000-memory.dmp

Filesize
540KB

Download
memory/2104-24-0x0000000000300000-0x0000000000387000-memory.dmp

Filesize
540KB

Download