e3c6cdda8ccd4d96f15cf840b366056f014e72870d90f852c8eb796791749d91

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ce4320e6e8af9176d71e8c4295e049e_JaffaCakes118.exe
Size

25KB
MD5

3ce4320e6e8af9176d71e8c4295e049e
SHA1

33a7dd5283e7abb56f35e53e5811ad255c17a6f6
SHA256

e3c6cdda8ccd4d96f15cf840b366056f014e72870d90f852c8eb796791749d91
SHA512

a6d9f90509513bcd80b4a12a11d421c301b3330a9a0d84a7695bca3e1cc38d21831ffa55da8386636e24d2fb02229202069f6e1b1a721c29a591bc1249ff29b1
SSDEEP

384:0hJV59Xn2JJkJOYaVX0MWJukFtrzWLvu87TtWAU5EAxfr6+e9Pfqbn1RW/W:0vcJAMG5z8u8nti5XxOha5

Score

8^/10

aspackv2 persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\A25D60EE\ImagePath = "C:\\Windows\\system32\\D28332E8.EXE -k"	3ce4320e6e8af9176d71e8c4295e049e_JaffaCakes118.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00080000000234b2-2.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4756	D28332E8.EXE

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\D28332E8.EXE	3ce4320e6e8af9176d71e8c4295e049e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\D28332E8.EXE	3ce4320e6e8af9176d71e8c4295e049e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\D28332E8.EXE	D28332E8.EXE
File created	C:\Windows\SysWOW64\9F24FCB4.DLL	D28332E8.EXE
File created	C:\Windows\SysWOW64\delme.bat	3ce4320e6e8af9176d71e8c4295e049e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2692	3ce4320e6e8af9176d71e8c4295e049e_JaffaCakes118.exe
2692	3ce4320e6e8af9176d71e8c4295e049e_JaffaCakes118.exe
4756	D28332E8.EXE
4756	D28332E8.EXE
4756	D28332E8.EXE
4756	D28332E8.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3144	2692	3ce4320e6e8af9176d71e8c4295e049e_JaffaCakes118.exe	87
PID 2692 wrote to memory of 3144	2692	3ce4320e6e8af9176d71e8c4295e049e_JaffaCakes118.exe	87
PID 2692 wrote to memory of 3144	2692	3ce4320e6e8af9176d71e8c4295e049e_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\3ce4320e6e8af9176d71e8c4295e049e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ce4320e6e8af9176d71e8c4295e049e_JaffaCakes118.exe"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\delme.bat
  2⤵
  PID:3144

C:\Windows\SysWOW64\D28332E8.EXE
C:\Windows\SysWOW64\D28332E8.EXE -k
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\D28332E8.EXE

Filesize
25KB

MD5
3ce4320e6e8af9176d71e8c4295e049e

SHA1
33a7dd5283e7abb56f35e53e5811ad255c17a6f6

SHA256
e3c6cdda8ccd4d96f15cf840b366056f014e72870d90f852c8eb796791749d91

SHA512
a6d9f90509513bcd80b4a12a11d421c301b3330a9a0d84a7695bca3e1cc38d21831ffa55da8386636e24d2fb02229202069f6e1b1a721c29a591bc1249ff29b1

Download Submit
C:\Windows\SysWOW64\delme.bat

Filesize
239B

MD5
17a18d244aacbd75f9dd09db8f48ecf0

SHA1
b6174211cca9b3388fafaf0269988fdaf097f5b1

SHA256
ca09ce5f41e48731821bdf38161c478153bb6c3daa756168f221f8077dcd7af0

SHA512
51e80bc27c1429a72ebcf4c33ac5c4070b291b8bcbecb6507d6c05e410e73f3245bf1f8aa03b17e6d6dea07bc62a4d6b0cd25ab4d23e4787f634ad531e5fc25b

Download Submit
memory/2692-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2692-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4756-10-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download