af065902ce4ca1ba7acfc3b0d08be7e8ae1edd73d7f99a17c1e5b504d7f76e94

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Size

13KB
MD5

0952a0a3751c5adc4c94e8b7a0be8546
SHA1

4bd79409e3cd7b1eec80350d334cd8433d7937d1
SHA256

af065902ce4ca1ba7acfc3b0d08be7e8ae1edd73d7f99a17c1e5b504d7f76e94
SHA512

1da986f545a7f499dbf1b9de1b3aae2a933be96114909d7f0d1a98743e662f717c63ad424e184ff441de906898fdb8271815b931de88a53059b6736951e26f00
SSDEEP

192:G0WPLOEYJFGY+fzWfzjwLUoeJ/RBkn30G90xHRc7o3TccU+TY0F+UtYtXae4W0v:G0WKDfg5e5RA30GyxHRio3gcUsHB9W0v

Score

7^/10

persistence privilege_escalation upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x002f000000015d14-5.dat	acprotect

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mst120.dll	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mst120.dll	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1768-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x002f000000015d14-5.dat	upx
behavioral1/memory/1768-8-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Wow6432Node\CLSID\{c069b9c1-bdb7-4858-9fe4-cb547e696cea}\InProcServer32\ = "C:\\Windows\\SysWow64\\mst120.dll"	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Wow6432Node\CLSID\{c069b9c1-bdb7-4858-9fe4-cb547e696cea}\InProcServer32\ThreadingModel = "Apartment"	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\PROTOCOLS	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\PROTOCOLS\Filter\text/html\ = "Microsoft Default HTML MIME Filter"	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Wow6432Node\CLSID\{c069b9c1-bdb7-4858-9fe4-cb547e696cea}\InProcServer32	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Wow6432Node	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Wow6432Node\CLSID\{c069b9c1-bdb7-4858-9fe4-cb547e696cea}	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\PROTOCOLS\Filter\text/html	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\PROTOCOLS\Filter	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\PROTOCOLS\Filter\text/html\CLSID = "{c069b9c1-bdb7-4858-9fe4-cb547e696cea}"	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Wow6432Node\CLSID	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1768	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mst120.dll

Filesize
8KB

MD5
9adb0d5dea0cb194df5f2e05beb583ca

SHA1
71820ebfb53273c4e073b83e5fd38a5d796f85b5

SHA256
456af7dc61ddeb2865b286b7a6bef46cec55dc21cf2bb08a4993bad4737fbe8e

SHA512
8175593417e295e1deaea332536a9b872cf38e85f1c52dc3495424dd59c093b447dbeb3bb5f98792e2e7b07fbc3cf655de442f2eb6a79547bce7ccf1b9cfdbff

Download Submit
memory/1768-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1768-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download