90aee6ad5ee73241e4974a4eb012759d8cfffe2209a8858583b127ac40fd65ce

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

63ebc4c81b8400d85c6e9ef2396d0805_JaffaCakes118.exe
Size

212KB
MD5

63ebc4c81b8400d85c6e9ef2396d0805
SHA1

b8984e2c03388b60f4f024001ef8b2400f893799
SHA256

90aee6ad5ee73241e4974a4eb012759d8cfffe2209a8858583b127ac40fd65ce
SHA512

afaed48637971d7f11a13bd283506dd2d7b9b6c5efe1301b3b20852e28419cac3321067cf7678402605d9b0e570a6c9f2e4cb6ef9be4d6ab8079f9db5d4e4606
SSDEEP

6144:Izz9B316segdivsA6sw0KR8+Sjg67A/f8uIymu:Wzh6rEArj+Sjg

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1640	Ujemya.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1504-0-0x0000000000400000-0x000000000047E000-memory.dmp	upx
behavioral1/files/0x0007000000016d04-11.dat	upx
behavioral1/memory/1640-13-0x0000000000400000-0x000000000047E000-memory.dmp	upx

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	63ebc4c81b8400d85c6e9ef2396d0805_JaffaCakes118.exe
File opened for modification	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	63ebc4c81b8400d85c6e9ef2396d0805_JaffaCakes118.exe
File created	C:\Windows\Ujemya.exe	63ebc4c81b8400d85c6e9ef2396d0805_JaffaCakes118.exe
File opened for modification	C:\Windows\Ujemya.exe	63ebc4c81b8400d85c6e9ef2396d0805_JaffaCakes118.exe
File created	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	Ujemya.exe
File opened for modification	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	Ujemya.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	Ujemya.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe
1640	Ujemya.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1504	63ebc4c81b8400d85c6e9ef2396d0805_JaffaCakes118.exe
1640	Ujemya.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1504	63ebc4c81b8400d85c6e9ef2396d0805_JaffaCakes118.exe
1640	Ujemya.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1640	1504	63ebc4c81b8400d85c6e9ef2396d0805_JaffaCakes118.exe	30
PID 1504 wrote to memory of 1640	1504	63ebc4c81b8400d85c6e9ef2396d0805_JaffaCakes118.exe	30
PID 1504 wrote to memory of 1640	1504	63ebc4c81b8400d85c6e9ef2396d0805_JaffaCakes118.exe	30
PID 1504 wrote to memory of 1640	1504	63ebc4c81b8400d85c6e9ef2396d0805_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\63ebc4c81b8400d85c6e9ef2396d0805_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63ebc4c81b8400d85c6e9ef2396d0805_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\Ujemya.exe
  C:\Windows\Ujemya.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of UnmapMainImage
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

Filesize
372B

MD5
a91f51b76e641a4489488e6b80a517c8

SHA1
c054b7456ee401a05d8feda2e1a5889e34e02b59

SHA256
fced789e9b235e543765655da8e719dedb0048883583a9783ad0b2207c0157f4

SHA512
20b0a50771ae554f299e6ed397a0b7c5986cf2b9841e0356e360209996f56fb2619fbf273437cbea55578f8cc2f2b55988820b56f643cee8cd0ea2b078d2a1be

Download Submit
C:\Windows\Ujemya.exe

Filesize
212KB

MD5
63ebc4c81b8400d85c6e9ef2396d0805

SHA1
b8984e2c03388b60f4f024001ef8b2400f893799

SHA256
90aee6ad5ee73241e4974a4eb012759d8cfffe2209a8858583b127ac40fd65ce

SHA512
afaed48637971d7f11a13bd283506dd2d7b9b6c5efe1301b3b20852e28419cac3321067cf7678402605d9b0e570a6c9f2e4cb6ef9be4d6ab8079f9db5d4e4606

Download Submit
memory/1504-12-0x0000000002280000-0x00000000022FE000-memory.dmp

Filesize
504KB

Download
memory/1504-3-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1504-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/1504-0-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1504-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1504-19724-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1504-44105-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/1504-47230-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1640-13-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1640-18-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1640-22-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1640-47232-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download