ee4280e0e2d9a5c6bc947561583a1119b62cd3a0c2a3269ecd58a9d5d0e5af22

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
Size

57KB
MD5

6478ac3e19d36be3d38df9e1088c3c47
SHA1

cdc84d74d530694c1e4a0755a98ebcd10cf4e096
SHA256

ee4280e0e2d9a5c6bc947561583a1119b62cd3a0c2a3269ecd58a9d5d0e5af22
SHA512

ab589e97cb90f3e2dc27a60f4d650cfbd83aaddf70975bb98d96fd9eccae9f95d5ecae632d688c5ef15e5f46a9c3a821f4793c4dfc7898e4d7a4660cf9469f26
SSDEEP

768:y2bdOEmDLwGT1S0wFwWNePqhvIQAoGj3dIiqbUZB0lWoB3HiOHpO0w5xjIlhPc:y2b0OGBeCW1vIb7IxOB0UmPA0w5OvPc

Score

8^/10

persistence upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\KPDrv.sys	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 1 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2632-0-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-9-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-10-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-11-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-12-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-13-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-14-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-15-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-16-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-17-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-18-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-19-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-20-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-21-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2632-22-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\InjectDLL.dll	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
472	Process not Found
472	Process not Found
472	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1188	2632	6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6478ac3e19d36be3d38df9e1088c3c47_JaffaCakes118.exe"
  2⤵
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1188-8-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/2632-15-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-16-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-12-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-14-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-18-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-19-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-20-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-21-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2632-22-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download