5d5864a7233c1ff5b4e261ae4711f1786e120a47865e5d0b0438cacb9d8c0611

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

642c657afabffca45c377bce3cb249d3_JaffaCakes118.exe
Size

312KB
MD5

642c657afabffca45c377bce3cb249d3
SHA1

31071b0724d0f3c87e7d85f64cf6f0eaf30f4669
SHA256

5d5864a7233c1ff5b4e261ae4711f1786e120a47865e5d0b0438cacb9d8c0611
SHA512

04223603d7ab8b558b8b84eaf9b42217205fb8b86c41c3c0dc5647c56425f8d2be341eb7bf4a37a5afd1fa0b1ff563aecd300fe0afc102a4dfa9ddf0af627049
SSDEEP

6144:3nlEoWaZknVIaVaHl/c+gLzTwWlAdG+GhOYxfdUv2oSKlu7:3lEoWlnVIYIlTQzlCqi2oSK07

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2764-0-0x0000000000400000-0x00000000004E1000-memory.dmp	upx
behavioral1/memory/2764-7-0x0000000000400000-0x00000000004E1000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	2764	WerFault.exe	29

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	642c657afabffca45c377bce3cb249d3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2764	642c657afabffca45c377bce3cb249d3_JaffaCakes118.exe
2764	642c657afabffca45c377bce3cb249d3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2728	2764	642c657afabffca45c377bce3cb249d3_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2728	2764	642c657afabffca45c377bce3cb249d3_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2728	2764	642c657afabffca45c377bce3cb249d3_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2728	2764	642c657afabffca45c377bce3cb249d3_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\642c657afabffca45c377bce3cb249d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\642c657afabffca45c377bce3cb249d3_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 1236
  2⤵
  - Program crash
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-0-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2764-7-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download