07d80d1ea50bf38e7dc49e30db756bfa4a9888dc215214a3912a143435225d7d

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
Size

445KB
MD5

602435b0571b0da5006a9313f2ae72d3
SHA1

cdf2d6f8913cf50dfa4988b28a4c09a0f4ea6082
SHA256

07d80d1ea50bf38e7dc49e30db756bfa4a9888dc215214a3912a143435225d7d
SHA512

6598df39904ee8d7f3feb4744e94995e7fa1090dbe8e5b6ce4d266f49cd66dfab2bf9ed4270d0897f229fc7a4372d5d801fe9098b8136e2c09f4cedf69a86dfc
SSDEEP

12288:YGHnThjLf1sJ4w+wsRFAWv5c6T+gty2KE9ZqgwU8Ap:rHThHfFw+TRnfp82KE9ZqE8Ap

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2368	postcard.exe
2440	postcard.exe
2696	postcard.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control Center = "postcard.exe"	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TaskMon = "C:\\Windows\\system32\\taskmon.exe"	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TaskMon = "C:\\Windows\\system32\\taskmon.exe"	postcard.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\taskmon.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\taskmon.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\taskmon.exe	postcard.exe
File created	C:\Windows\SysWOW64\taskmon.exe	postcard.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2384 set thread context of 2516	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	30
PID 2384 set thread context of 1688	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	31
PID 2368 set thread context of 2440	2368	postcard.exe	34
PID 2368 set thread context of 2696	2368	postcard.exe	35

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\program files\kazaa\my shared folder\Google ADsense clicking bot.SFX.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\Ashampoo PowerUp v3.10.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\Norton Anti-Virus 2008 Enterprise Crack.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa lite k++\my shared folder\Shadow Security Scanner 10 Gold.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\SuperRam 5.1.28.2008.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\emule\incoming\AOL Password Cracker.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\limewire\shared\YZdock Machintos osX like toolbar for windows.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\tesla\files\Sophos antivirus updater bypass.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\AOL Password Cracker.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa lite\my shared folder\TCN ISO cable modem hacking tools.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa lite k++\my shared folder\SuperRam 5.1.28.2008.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\Canvas Security Framework 2008 LiMiTeD with 50 0day.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\Hotmail spammer bot.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\emule\incoming\Anti-Trojan Elite v4.01.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\limewire\shared\BitDefender AntiVirus 2008 Keygen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\limewire\shared\SuperRam 5.1.28.2008.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\winmx\shared\Error Doctor 2008.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\winmx\shared\DivX 5.0 Pro KeyGen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\Acker DVD Ripper 2008.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\emule\incoming\ProRat 2.0 Special Edition.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\winmx\shared\Hotmail account bruteforcer bot.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa lite k++\my shared folder\ProRat 2.0 Special Edition.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\Hotmail account bruteforcer bot.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\icq\shared folder\Absolute Video Converter 3.07.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\emule\incoming\Email Spider.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\Adobe Acrobat Reader keygen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\SuperRam 5.1.28.2008.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\limewire\shared\VMware Workstation 6 Windows keygen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\limewire\shared\DivX 5.0 Pro KeyGen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\winmx\shared\Super Utilities Pro 2008 8.0.1980.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa lite k++\my shared folder\VmWare ESX GSX server keygen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\tesla\files\Ashampoo PowerUp v3.10.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\tesla\files\Hotmail spammer bot.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa lite\my shared folder\Password Cracker.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\Boilsoft DVD Ripper 2.82.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\Microsoft Visual Studio KeyGen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\Absolute Video Converter 3.07.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\Super Utilities Pro 2008 8.0.1980.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa lite\my shared folder\Acker DVD Ripper 2008.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa lite\my shared folder\PC Secuity Tweaker 7.6.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\Mirc Keygen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa lite\my shared folder\BitDefender AntiVirus 2008 Keygen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\icq\shared folder\Windows 2003 Advanced Server KeyGen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\Email Spider.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\limewire\shared\VmWare ESX GSX server keygen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\VmWare ESX GSX server keygen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\Microsoft Visual Studio KeyGen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\Adobe Soundbooth CS3.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\CleanMyPC Registry Cleaner v4.02.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\emule\incoming\Youtube Music Downloader 1.0.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\VmWare keygen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\Icepack IDT Gold edition 2008 LEAKED.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\VMware Workstation 6 Windows keygen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\icq\shared folder\CleanMyPC Registry Cleaner v4.02.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\Download Boost 2.0.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\winmx\shared\Absolute Video Converter 3.07.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\winmx\shared\Icepack IDT Gold edition 2008 LEAKED.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\limewire\shared\Adobe Soundbooth CS3.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\tesla\files\Windows 2003 Advanced Server KeyGen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\icq\shared folder\Google ADsense clicking bot.SFX.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\tesla\files\Microsoft Visual Basic KeyGen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\BitDefender AntiVirus 2008 Keygen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\kazaa lite k++\my shared folder\TCN ISO cable modem hacking tools.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File created	C:\program files\emule\incoming\Mirc Keygen.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\postcard.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
File opened for modification	C:\Windows\postcard.exe	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2516	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2516	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2516	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2516	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2516	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2516	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	30
PID 2384 wrote to memory of 1688	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	31
PID 2384 wrote to memory of 1688	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	31
PID 2384 wrote to memory of 1688	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	31
PID 2384 wrote to memory of 1688	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	31
PID 2384 wrote to memory of 1688	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	31
PID 2384 wrote to memory of 1688	2384	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	31
PID 2516 wrote to memory of 1972	2516	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	32
PID 2516 wrote to memory of 1972	2516	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	32
PID 2516 wrote to memory of 1972	2516	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	32
PID 2516 wrote to memory of 1972	2516	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	32
PID 1688 wrote to memory of 2368	1688	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2368	1688	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2368	1688	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2368	1688	602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe	33
PID 2368 wrote to memory of 2440	2368	postcard.exe	34
PID 2368 wrote to memory of 2440	2368	postcard.exe	34
PID 2368 wrote to memory of 2440	2368	postcard.exe	34
PID 2368 wrote to memory of 2440	2368	postcard.exe	34
PID 2368 wrote to memory of 2440	2368	postcard.exe	34
PID 2368 wrote to memory of 2440	2368	postcard.exe	34
PID 2368 wrote to memory of 2696	2368	postcard.exe	35
PID 2368 wrote to memory of 2696	2368	postcard.exe	35
PID 2368 wrote to memory of 2696	2368	postcard.exe	35
PID 2368 wrote to memory of 2696	2368	postcard.exe	35
PID 2368 wrote to memory of 2696	2368	postcard.exe	35
PID 2368 wrote to memory of 2696	2368	postcard.exe	35

C:\Users\Admin\AppData\Local\Temp\602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\notepad.exe
    notepad C:\Users\Admin\AppData\Local\Temp\Message
    3⤵
    PID:1972
- C:\Users\Admin\AppData\Local\Temp\602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\602435b0571b0da5006a9313f2ae72d3_JaffaCakes118.exe
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\postcard.exe
    "C:\Windows\postcard.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Windows\postcard.exe
      C:\Windows\postcard.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      PID:2440
  - - C:\Windows\postcard.exe
      C:\Windows\postcard.exe
      4⤵
      Executes dropped EXE
      PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Message

Filesize
4KB

MD5
c5d37fe4751f17707af6c5f433510cba

SHA1
6a0de5fae9d977e6716580fefb4125b78c3929ac

SHA256
4069f4e624c2c861fec6273d7fb6ce64241d6b7b226143176782887b34873502

SHA512
ce073e7fe1906e3ac097505096963597f35174a3de7bc2ccf2b42557ccd6fc7d4fabcc05ab937711586b5bd0239fe070e0bc9f6f07e6050cec4e345d0dd6b214

Download Submit
C:\Windows\postcard.exe

Filesize
445KB

MD5
602435b0571b0da5006a9313f2ae72d3

SHA1
cdf2d6f8913cf50dfa4988b28a4c09a0f4ea6082

SHA256
07d80d1ea50bf38e7dc49e30db756bfa4a9888dc215214a3912a143435225d7d

SHA512
6598df39904ee8d7f3feb4744e94995e7fa1090dbe8e5b6ce4d266f49cd66dfab2bf9ed4270d0897f229fc7a4372d5d801fe9098b8136e2c09f4cedf69a86dfc

Download Submit
memory/1688-44-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1688-10-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1688-7-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1688-16-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1688-13-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2368-27-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2368-39-0x0000000000010000-0x000000000008C000-memory.dmp

Filesize
496KB

Download
memory/2384-14-0x0000000000010000-0x000000000008C000-memory.dmp

Filesize
496KB

Download
memory/2440-43-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/2516-1-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/2516-5-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/2516-6-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/2516-17-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/2516-11-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/2516-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2696-45-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads