1bc82badd73d98a0096c156a32da464080c5c2f547d59283e935fe32a69806a4

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4724143e7b758926f4dfcb151eb7a29b_JaffaCakes118.exe
Size

125KB
MD5

4724143e7b758926f4dfcb151eb7a29b
SHA1

793960b51e8edb184ce2c62c76adeb87a933e910
SHA256

1bc82badd73d98a0096c156a32da464080c5c2f547d59283e935fe32a69806a4
SHA512

c0fb9b77a217c1708412a7c72d1a9183f6425a03895f3a34ff9e53521cc87e0900f4e6d927bdccfe4cb4595c2391b86c8e1ffd9b2aefe6dfd7497b96fc02fed6
SSDEEP

3072:EJgwBIxhn+dz7diTqkGqcZBUPs7dHNnu3lAzyDJkluJfBd8f:EuwWx8fScnUPey1BtB

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2388	Zsamya.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Zsamya.exe	4724143e7b758926f4dfcb151eb7a29b_JaffaCakes118.exe
File created	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	Zsamya.exe
File opened for modification	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	Zsamya.exe
File created	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	4724143e7b758926f4dfcb151eb7a29b_JaffaCakes118.exe
File opened for modification	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	4724143e7b758926f4dfcb151eb7a29b_JaffaCakes118.exe
File created	C:\Windows\Zsamya.exe	4724143e7b758926f4dfcb151eb7a29b_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	Zsamya.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International	Zsamya.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe
2388	Zsamya.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2388	Zsamya.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2388	3064	4724143e7b758926f4dfcb151eb7a29b_JaffaCakes118.exe	30
PID 3064 wrote to memory of 2388	3064	4724143e7b758926f4dfcb151eb7a29b_JaffaCakes118.exe	30
PID 3064 wrote to memory of 2388	3064	4724143e7b758926f4dfcb151eb7a29b_JaffaCakes118.exe	30
PID 3064 wrote to memory of 2388	3064	4724143e7b758926f4dfcb151eb7a29b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4724143e7b758926f4dfcb151eb7a29b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4724143e7b758926f4dfcb151eb7a29b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\Zsamya.exe
  C:\Windows\Zsamya.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

Filesize
372B

MD5
d912c3db9c4735f70b8c0aa8e7e899e8

SHA1
a565dad683866e4dd0048bddab9a7647db73c592

SHA256
76f3fe7b2a2c4c374669cd5eac3801fa143a9f477ae04551609402634b8ccde4

SHA512
aee0d9684c2486b1a22f56f77ca80cf744269969eb38b164b13d64ea3ab3e11af37a5db9856ae11f18f3fb940920b3b210e278eccaf2e30ad8f80645f65a5576

Download Submit
C:\Windows\Zsamya.exe

Filesize
125KB

MD5
4724143e7b758926f4dfcb151eb7a29b

SHA1
793960b51e8edb184ce2c62c76adeb87a933e910

SHA256
1bc82badd73d98a0096c156a32da464080c5c2f547d59283e935fe32a69806a4

SHA512
c0fb9b77a217c1708412a7c72d1a9183f6425a03895f3a34ff9e53521cc87e0900f4e6d927bdccfe4cb4595c2391b86c8e1ffd9b2aefe6dfd7497b96fc02fed6

Download Submit
memory/2388-46443-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2388-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2388-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2388-46441-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2388-46442-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2388-46444-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2388-46446-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2388-46450-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3064-0-0x0000000000250000-0x0000000000263000-memory.dmp

Filesize
76KB

Download
memory/3064-46440-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3064-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download