92228921c21fe9b8e87b0bcfd1cd9bc517a361b39bb1da5da1d1c21dd803ffdd

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43447d178568ebca089f3926c4647b0c_JaffaCakes118.exe
Size

312KB
MD5

43447d178568ebca089f3926c4647b0c
SHA1

16ddc0faeacbfb45bde6e5e6611569628cd044a9
SHA256

92228921c21fe9b8e87b0bcfd1cd9bc517a361b39bb1da5da1d1c21dd803ffdd
SHA512

0d9fc4904d9a3e8a436df5f9eb2bb9fbfa924826748c53773c5868553a94def1dd509a612b9c4b7f7e5b512b7a930794ededede9604165574b2fecfa6018009d
SSDEEP

6144:xWI+jNXUe+FToCRTy7wzFzRODpyUOr2//I2TnLo0DtO:EIQUNoCvxzKy1rc/IsK

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2680	izefw.exe

Loads dropped DLL 1 IoCs

pid	Process
2184	43447d178568ebca089f3926c4647b0c_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\{09E0E5E8-6808-AD4F-43B0-714965AC5254} = "C:\\Users\\Admin\\AppData\\Roaming\\Ifful\\izefw.exe"	izefw.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe
2680	izefw.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2680	2184	43447d178568ebca089f3926c4647b0c_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2680	2184	43447d178568ebca089f3926c4647b0c_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2680	2184	43447d178568ebca089f3926c4647b0c_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2680	2184	43447d178568ebca089f3926c4647b0c_JaffaCakes118.exe	30
PID 2680 wrote to memory of 1124	2680	izefw.exe	19
PID 2680 wrote to memory of 1124	2680	izefw.exe	19
PID 2680 wrote to memory of 1124	2680	izefw.exe	19
PID 2680 wrote to memory of 1124	2680	izefw.exe	19
PID 2680 wrote to memory of 1124	2680	izefw.exe	19
PID 2680 wrote to memory of 1172	2680	izefw.exe	20
PID 2680 wrote to memory of 1172	2680	izefw.exe	20
PID 2680 wrote to memory of 1172	2680	izefw.exe	20
PID 2680 wrote to memory of 1172	2680	izefw.exe	20
PID 2680 wrote to memory of 1172	2680	izefw.exe	20
PID 2680 wrote to memory of 1268	2680	izefw.exe	21
PID 2680 wrote to memory of 1268	2680	izefw.exe	21
PID 2680 wrote to memory of 1268	2680	izefw.exe	21
PID 2680 wrote to memory of 1268	2680	izefw.exe	21
PID 2680 wrote to memory of 1268	2680	izefw.exe	21
PID 2680 wrote to memory of 1536	2680	izefw.exe	25
PID 2680 wrote to memory of 1536	2680	izefw.exe	25
PID 2680 wrote to memory of 1536	2680	izefw.exe	25
PID 2680 wrote to memory of 1536	2680	izefw.exe	25
PID 2680 wrote to memory of 1536	2680	izefw.exe	25
PID 2680 wrote to memory of 2184	2680	izefw.exe	29
PID 2680 wrote to memory of 2184	2680	izefw.exe	29
PID 2680 wrote to memory of 2184	2680	izefw.exe	29
PID 2680 wrote to memory of 2184	2680	izefw.exe	29
PID 2680 wrote to memory of 2184	2680	izefw.exe	29
PID 2680 wrote to memory of 2220	2680	izefw.exe	31
PID 2680 wrote to memory of 2220	2680	izefw.exe	31
PID 2680 wrote to memory of 2220	2680	izefw.exe	31
PID 2680 wrote to memory of 2220	2680	izefw.exe	31
PID 2680 wrote to memory of 2220	2680	izefw.exe	31

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\43447d178568ebca089f3926c4647b0c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\43447d178568ebca089f3926c4647b0c_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Users\Admin\AppData\Roaming\Ifful\izefw.exe
    "C:\Users\Admin\AppData\Roaming\Ifful\izefw.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2680

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1536

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Ifful\izefw.exe

Filesize
312KB

MD5
a21d409bd992eaf6a17cc306f19c38ad

SHA1
8adcba9d1a6603b423f415c10498a179b4318668

SHA256
352b0fa44cc31337ae4d77988e56a8d246bb330f56b159efd0a6672e5b707e03

SHA512
cf945a629bc93c164ac9b5d2c172a9402f1ae9f40879db7eba83eaac935b8dd77b15f8410ff755776eeeeddb111b9d20a8d23c1f8d4541c63ed1b94f3a1952e7

Download Submit
memory/1124-17-0x0000000000310000-0x0000000000354000-memory.dmp

Filesize
272KB

Download
memory/1124-16-0x0000000000310000-0x0000000000354000-memory.dmp

Filesize
272KB

Download
memory/1124-14-0x0000000000310000-0x0000000000354000-memory.dmp

Filesize
272KB

Download
memory/1124-18-0x0000000000310000-0x0000000000354000-memory.dmp

Filesize
272KB

Download
memory/1124-15-0x0000000000310000-0x0000000000354000-memory.dmp

Filesize
272KB

Download
memory/1172-20-0x0000000000370000-0x00000000003B4000-memory.dmp

Filesize
272KB

Download
memory/1172-21-0x0000000000370000-0x00000000003B4000-memory.dmp

Filesize
272KB

Download
memory/1172-22-0x0000000000370000-0x00000000003B4000-memory.dmp

Filesize
272KB

Download
memory/1172-23-0x0000000000370000-0x00000000003B4000-memory.dmp

Filesize
272KB

Download
memory/1268-28-0x0000000002E70000-0x0000000002EB4000-memory.dmp

Filesize
272KB

Download
memory/1268-27-0x0000000002E70000-0x0000000002EB4000-memory.dmp

Filesize
272KB

Download
memory/1268-26-0x0000000002E70000-0x0000000002EB4000-memory.dmp

Filesize
272KB

Download
memory/1268-25-0x0000000002E70000-0x0000000002EB4000-memory.dmp

Filesize
272KB

Download
memory/1536-32-0x0000000001E50000-0x0000000001E94000-memory.dmp

Filesize
272KB

Download
memory/1536-33-0x0000000001E50000-0x0000000001E94000-memory.dmp

Filesize
272KB

Download
memory/1536-30-0x0000000001E50000-0x0000000001E94000-memory.dmp

Filesize
272KB

Download
memory/1536-31-0x0000000001E50000-0x0000000001E94000-memory.dmp

Filesize
272KB

Download
memory/2184-1-0x000000007EF60000-0x000000007EFA4000-memory.dmp

Filesize
272KB

Download
memory/2184-2-0x000000007EF60000-0x000000007EFA4000-memory.dmp

Filesize
272KB

Download
memory/2184-38-0x0000000000130000-0x0000000000174000-memory.dmp

Filesize
272KB

Download
memory/2184-42-0x0000000000130000-0x0000000000174000-memory.dmp

Filesize
272KB

Download
memory/2184-48-0x00000000002F0000-0x0000000000341000-memory.dmp

Filesize
324KB

Download
memory/2184-49-0x000000007EF60000-0x000000007EFA4000-memory.dmp

Filesize
272KB

Download
memory/2184-50-0x0000000000130000-0x0000000000174000-memory.dmp

Filesize
272KB

Download
memory/2184-40-0x0000000000130000-0x0000000000174000-memory.dmp

Filesize
272KB

Download
memory/2184-3-0x000000007EF60000-0x000000007EFA4000-memory.dmp

Filesize
272KB

Download
memory/2184-4-0x000000007EF60000-0x000000007EFA4000-memory.dmp

Filesize
272KB

Download
memory/2184-10-0x0000000000130000-0x0000000000181000-memory.dmp

Filesize
324KB

Download
memory/2184-36-0x0000000000130000-0x0000000000174000-memory.dmp

Filesize
272KB

Download
memory/2184-0-0x00000000002F0000-0x0000000000341000-memory.dmp

Filesize
324KB

Download
memory/2220-71-0x0000000001C40000-0x0000000001C84000-memory.dmp

Filesize
272KB

Download
memory/2220-74-0x0000000001C40000-0x0000000001C84000-memory.dmp

Filesize
272KB

Download
memory/2220-72-0x0000000001C40000-0x0000000001C84000-memory.dmp

Filesize
272KB

Download
memory/2220-73-0x0000000001C40000-0x0000000001C84000-memory.dmp

Filesize
272KB

Download
memory/2680-12-0x00000000012C0000-0x0000000001311000-memory.dmp

Filesize
324KB

Download
memory/2680-45-0x000000007EF60000-0x000000007EFA4000-memory.dmp

Filesize
272KB

Download
memory/2680-51-0x000000007EF60000-0x000000007EFA4000-memory.dmp

Filesize
272KB

Download
memory/2680-57-0x00000000012C0000-0x0000000001311000-memory.dmp

Filesize
324KB

Download
memory/2680-58-0x000000007EF60000-0x000000007EFA4000-memory.dmp

Filesize
272KB

Download
memory/2680-60-0x000000007EF60000-0x000000007EFA4000-memory.dmp

Filesize
272KB

Download