616a50e518ea9e108b8f2c9811ac33119cb1f0c6a0f1de3df5cb2cf66e4c24fc

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe
Size

244KB
MD5

4a61d7259e5bc8039c885617f330c832
SHA1

58f31adb13aa0509a48cf371268791971dfbe270
SHA256

616a50e518ea9e108b8f2c9811ac33119cb1f0c6a0f1de3df5cb2cf66e4c24fc
SHA512

36a9048283c03ddae502585660ce6b2b9a450c9f32fcc49a5f1a18c1c5b6623089172467ae61b1b7adfcbe02a919bb99ad67e643fe9ca67031a290544185b33f
SSDEEP

6144:oHsUV65Id2L0wHcIwXhv+EhlK7Q5qux9BJiRS:cBV6asQw8ph2EhlPZ9qS

Score

8^/10

persistence upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\npf.sys	4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
2656	4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe
2656	4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2656-2-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral1/memory/2656-6-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral1/memory/2656-4-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral1/memory/2656-11-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral1/memory/2656-19-0x0000000000400000-0x000000000049A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sniffer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe"	4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Packet.dll	4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wpcap.dll	4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	2656	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2656	4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2832	2656	4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe	30
PID 2656 wrote to memory of 2832	2656	4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe	30
PID 2656 wrote to memory of 2832	2656	4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe	30
PID 2656 wrote to memory of 2832	2656	4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 104
  2⤵
  - Program crash
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\Packet.dll

Filesize
98KB

MD5
b4d3cbc053e70143d350d6107b94952c

SHA1
5ebdb0ef1f00a1024637adf106d7b2a9b43bbcda

SHA256
2198fd8cd738d6281c8c1fc4845effd251b3d6b7f83b9f4f927d6430cf12537b

SHA512
539244352ffc0ca6e08bba2704abd1286873375dad28421862bd9ce7a8146d9472dc5e4ac3edb59ae741f5b178cd22f976fbba62a0bc71c09160e1c9f178e523

Download Submit
\Windows\SysWOW64\wpcap.dll

Filesize
274KB

MD5
dae5f233818083af69e2e5133a50a2cb

SHA1
18a2672972a9440f51b3d416a933b20b8ae6252a

SHA256
b0ce20a14e8cef5a94e2ef057e5685eac3636c6b71166b4f99af31c3422c4121

SHA512
ca71f6b0c2c1f5c00eda9af97b4426c9ca386785c5f0d712dc971ddf0b13e1a0e7ef691932b61c5fda009df2da8422df09ffaf5061aa0b674a98dcc57caa405a

Download Submit
memory/2656-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2656-2-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2656-6-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2656-4-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2656-8-0x0000000000460000-0x0000000000493000-memory.dmp

Filesize
204KB

Download
memory/2656-11-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2656-16-0x0000000000340000-0x0000000000359000-memory.dmp

Filesize
100KB

Download
memory/2656-19-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2656-21-0x0000000000460000-0x0000000000493000-memory.dmp

Filesize
204KB

Download