e1f83f90649d472ee25301292f0aa85126aa2b082ea7e9805bc665cab98088b2

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe
Size

75KB
MD5

4cdc3ae9a4d06fcac31dc930ed93a02c
SHA1

bcf940e2388861c7848be00a9f88cf89354896bb
SHA256

e1f83f90649d472ee25301292f0aa85126aa2b082ea7e9805bc665cab98088b2
SHA512

b8a8785c37e41594b8f2101247f9bf73af9e999635ed25516c6e61b04494f08c475c8051c054e232028ef913619544d367d9e7e80ea58ca6508da128451a0d7c
SSDEEP

1536:uzyRz2E09GAzcg1q8P1mVDcb7dKOSGN8xMwhQZj9MR5QV2tuYQ:h4Pcgk1ZcdKO3a5RjtD

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/3044-5690-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/2696-13448-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cognac = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe"	4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International	4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2696	4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe
2696	4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2696	3044	4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe	30
PID 3044 wrote to memory of 2696	3044	4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe	30
PID 3044 wrote to memory of 2696	3044	4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe	30
PID 3044 wrote to memory of 2696	3044	4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\4cdc3ae9a4d06fcac31dc930ed93a02c_JaffaCakes118.exe
  2⤵
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2696-13445-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/2696-13446-0x00000000041A0000-0x00000000041A1000-memory.dmp

Filesize
4KB

Download
memory/2696-13447-0x00000000041A0000-0x00000000041A1000-memory.dmp

Filesize
4KB

Download
memory/2696-13448-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2696-13450-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/3044-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3044-5690-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads