a92ad73c5b612720d3561622c6e11f18613d0ea39234870d6f6879e45d358f92

Analysis

max time kernel
150s
max time network
136s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe
Size

262KB
MD5

4736226d9a237c905fad4c5c89eb61d1
SHA1

b1e6731b1ced0ab43e986460c478d4c9d9497bef
SHA256

a92ad73c5b612720d3561622c6e11f18613d0ea39234870d6f6879e45d358f92
SHA512

17efec0e254e4a4a4fb7941bc5c935b6c3227f787e5a58cf86dda4cac538bfef459aee509fc8fe1d44c7890c79a96c8b0f027ccdd98980e8d3ad28818b200a86
SSDEEP

6144:Hv8Gp+df0afmVTRMdNdpn94sLrNXel9jb98+MATD:P8YkfXf4TRMj94svNuzjb9ZJ

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2948	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2580	ejku.exe

Loads dropped DLL 1 IoCs

pid	Process
2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\{36F482E8-6FE9-AD4F-5F98-37194FCB1404} = "C:\\Users\\Admin\\AppData\\Roaming\\Vuurul\\ejku.exe"	ejku.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2676 set thread context of 2948	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	29

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Privacy	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe
2580	ejku.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe
Token: SeSecurityPrivilege	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe
Token: SeSecurityPrivilege	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe
2580	ejku.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2580	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	28
PID 2676 wrote to memory of 2580	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	28
PID 2676 wrote to memory of 2580	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	28
PID 2676 wrote to memory of 2580	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	28
PID 2580 wrote to memory of 1116	2580	ejku.exe	19
PID 2580 wrote to memory of 1116	2580	ejku.exe	19
PID 2580 wrote to memory of 1116	2580	ejku.exe	19
PID 2580 wrote to memory of 1116	2580	ejku.exe	19
PID 2580 wrote to memory of 1116	2580	ejku.exe	19
PID 2580 wrote to memory of 1176	2580	ejku.exe	20
PID 2580 wrote to memory of 1176	2580	ejku.exe	20
PID 2580 wrote to memory of 1176	2580	ejku.exe	20
PID 2580 wrote to memory of 1176	2580	ejku.exe	20
PID 2580 wrote to memory of 1176	2580	ejku.exe	20
PID 2580 wrote to memory of 1212	2580	ejku.exe	21
PID 2580 wrote to memory of 1212	2580	ejku.exe	21
PID 2580 wrote to memory of 1212	2580	ejku.exe	21
PID 2580 wrote to memory of 1212	2580	ejku.exe	21
PID 2580 wrote to memory of 1212	2580	ejku.exe	21
PID 2580 wrote to memory of 1704	2580	ejku.exe	23
PID 2580 wrote to memory of 1704	2580	ejku.exe	23
PID 2580 wrote to memory of 1704	2580	ejku.exe	23
PID 2580 wrote to memory of 1704	2580	ejku.exe	23
PID 2580 wrote to memory of 1704	2580	ejku.exe	23
PID 2580 wrote to memory of 2676	2580	ejku.exe	27
PID 2580 wrote to memory of 2676	2580	ejku.exe	27
PID 2580 wrote to memory of 2676	2580	ejku.exe	27
PID 2580 wrote to memory of 2676	2580	ejku.exe	27
PID 2580 wrote to memory of 2676	2580	ejku.exe	27
PID 2676 wrote to memory of 2948	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	29
PID 2676 wrote to memory of 2948	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	29
PID 2676 wrote to memory of 2948	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	29
PID 2676 wrote to memory of 2948	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	29
PID 2676 wrote to memory of 2948	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	29
PID 2676 wrote to memory of 2948	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	29
PID 2676 wrote to memory of 2948	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	29
PID 2676 wrote to memory of 2948	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	29
PID 2676 wrote to memory of 2948	2676	4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe	29

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1116

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1176

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4736226d9a237c905fad4c5c89eb61d1_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Users\Admin\AppData\Roaming\Vuurul\ejku.exe
    "C:\Users\Admin\AppData\Roaming\Vuurul\ejku.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:2580
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp584b7715.bat"
    3⤵
    - Deletes itself
    PID:2948

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp584b7715.bat

Filesize
271B

MD5
c0f02d9ac01005354648baab18cfb324

SHA1
535aeec00ea368130c935f2f5fa895b58a6135c7

SHA256
4177a3addfd7a61494270bfb73d3e7168c96ac3a1c35f1fc427d5363cacb054a

SHA512
5728646e7575be6e317ae7895801df25309dbefbd66cef2af0ab5ed241cc9b95af8cd6cb01238be1d5ee515b7e3b4372fe7400e70c961a3840062d4a1a234bb5

Download Submit
C:\Users\Admin\AppData\Roaming\Syho\suvej.ijf

Filesize
380B

MD5
bac2ca994de01bd4661b67c36ca509a6

SHA1
95c2c6587b75527f28f69546d66751829cfd30de

SHA256
30f9cf66c9a3a2afdd1c07638b0a18e96d568dccd363ee5473ef4b3ad0e78ce3

SHA512
ddb86d211f00b834fc339c6f181cc6e2cf0f14898eed05fb3ce2a632c142cfa711e8cf7c54cd033623dc9b1a87dcfbb1135eaec7f7b5286b96c50eecb5139c26

Download Submit
\Users\Admin\AppData\Roaming\Vuurul\ejku.exe

Filesize
262KB

MD5
232a5fc766f7428e8470e793d9dc1e79

SHA1
fe7a8e10a423e030e4ca2d7182415a8381888ca8

SHA256
b66e1d099fd88712a9840237ff9b9c45e3a2e4a1cd2b2ee1bf417e250ae88cf8

SHA512
0ee4335ea4511405ab11a87fcc1a971d852b51dffb2ca428db781966e9039fb1a6c9db7271600fbbf0664ab79397a70334dac11f437f53c841224b1a876d6b27

Download Submit
memory/1116-22-0x0000000001EB0000-0x0000000001EF1000-memory.dmp

Filesize
260KB

Download
memory/1116-18-0x0000000001EB0000-0x0000000001EF1000-memory.dmp

Filesize
260KB

Download
memory/1116-20-0x0000000001EB0000-0x0000000001EF1000-memory.dmp

Filesize
260KB

Download
memory/1116-16-0x0000000001EB0000-0x0000000001EF1000-memory.dmp

Filesize
260KB

Download
memory/1116-24-0x0000000001EB0000-0x0000000001EF1000-memory.dmp

Filesize
260KB

Download
memory/1176-31-0x0000000000380000-0x00000000003C1000-memory.dmp

Filesize
260KB

Download
memory/1176-28-0x0000000000380000-0x00000000003C1000-memory.dmp

Filesize
260KB

Download
memory/1176-29-0x0000000000380000-0x00000000003C1000-memory.dmp

Filesize
260KB

Download
memory/1176-30-0x0000000000380000-0x00000000003C1000-memory.dmp

Filesize
260KB

Download
memory/1212-36-0x0000000002D50000-0x0000000002D91000-memory.dmp

Filesize
260KB

Download
memory/1212-34-0x0000000002D50000-0x0000000002D91000-memory.dmp

Filesize
260KB

Download
memory/1212-35-0x0000000002D50000-0x0000000002D91000-memory.dmp

Filesize
260KB

Download
memory/1212-33-0x0000000002D50000-0x0000000002D91000-memory.dmp

Filesize
260KB

Download
memory/1704-38-0x0000000001C70000-0x0000000001CB1000-memory.dmp

Filesize
260KB

Download
memory/1704-41-0x0000000001C70000-0x0000000001CB1000-memory.dmp

Filesize
260KB

Download
memory/1704-40-0x0000000001C70000-0x0000000001CB1000-memory.dmp

Filesize
260KB

Download
memory/1704-39-0x0000000001C70000-0x0000000001CB1000-memory.dmp

Filesize
260KB

Download
memory/2580-12-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2580-277-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2580-279-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2580-13-0x0000000000370000-0x00000000003B5000-memory.dmp

Filesize
276KB

Download
memory/2580-14-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-78-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-68-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-61-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-59-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-57-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-55-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-53-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-50-0x0000000000530000-0x0000000000571000-memory.dmp

Filesize
260KB

Download
memory/2676-48-0x0000000000530000-0x0000000000571000-memory.dmp

Filesize
260KB

Download
memory/2676-46-0x0000000000530000-0x0000000000571000-memory.dmp

Filesize
260KB

Download
memory/2676-44-0x0000000000530000-0x0000000000571000-memory.dmp

Filesize
260KB

Download
memory/2676-65-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-67-0x00000000776C0000-0x00000000776C1000-memory.dmp

Filesize
4KB

Download
memory/2676-63-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-70-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-72-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-153-0x0000000000390000-0x00000000003D5000-memory.dmp

Filesize
276KB

Download
memory/2676-154-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-74-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-76-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-134-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-0-0x0000000000280000-0x00000000002C1000-memory.dmp

Filesize
260KB

Download
memory/2676-52-0x0000000000530000-0x0000000000571000-memory.dmp

Filesize
260KB

Download
memory/2676-3-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-4-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-5-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-1-0x0000000000390000-0x00000000003D5000-memory.dmp

Filesize
276KB

Download
memory/2676-2-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download