a33fa300d16edc9c42c2750ca4d4c26ca43a681a003ec47ac2de08ed02adbb3c

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

400a90de71631b17811807e75c385142_JaffaCakes118.exe
Size

856KB
MD5

400a90de71631b17811807e75c385142
SHA1

7a37bd88be9796e096b5595987f6d0dd17bb9399
SHA256

a33fa300d16edc9c42c2750ca4d4c26ca43a681a003ec47ac2de08ed02adbb3c
SHA512

01640a4d74be46367d95c29bb554fc343588c16e745e7b1f332462c1278c96e8cdb22b986c31647ac5b90acf37490d755007fd7afd95816a31ee5e23e0a826c3
SSDEEP

12288:oyek4X6pJgpbvWIiDKedzQTsV9sF38Y9CZtR8J7YFpxpWLFVEZxuko:oyd4cWbNs9UKgC57vsLO

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2036-1-0x0000000000400000-0x0000000000629000-memory.dmp	vmprotect
behavioral1/memory/2036-0-0x0000000000400000-0x0000000000629000-memory.dmp	vmprotect
behavioral1/memory/2036-8-0x0000000000400000-0x0000000000629000-memory.dmp	vmprotect

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	400a90de71631b17811807e75c385142_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2008	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2008	AUDIODG.EXE
Token: 33	2008	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2008	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2036	400a90de71631b17811807e75c385142_JaffaCakes118.exe
2036	400a90de71631b17811807e75c385142_JaffaCakes118.exe
2036	400a90de71631b17811807e75c385142_JaffaCakes118.exe
2036	400a90de71631b17811807e75c385142_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\400a90de71631b17811807e75c385142_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\400a90de71631b17811807e75c385142_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2036

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WK27LCMU\bOgDCYLPL[1].js

Filesize
33KB

MD5
54285d7f26ed4bc84ba79113426dcecb

SHA1
17dc89efec5df34a280459ffc0e27cb8467045ab

SHA256
b0754afe500a24201f740ed9c023d64483ca9183fa6361d759bb329462d25344

SHA512
88afabcad8dbb0f49cdea27c64783ec98ece295f139d50029d524950a5b40a7971f033529f7b60e5acdef5f0576bdcf107fa733bf439cc76693b654ebdd9a8df

Download Submit
memory/2036-1-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/2036-0-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/2036-8-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download