86584928126b210987919b533525f52937b87a2877130a39d456a37ccb9ee828

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
Size

792KB
MD5

1a4e0616d3bb6faaae67c2b9655b3691
SHA1

1063f0d26a161d91dec14755a65862be23f4d011
SHA256

86584928126b210987919b533525f52937b87a2877130a39d456a37ccb9ee828
SHA512

5d76bd1801a66e51d326aabc15e7fb3464590726101e72789917d287b1c5eb1afe48c4be5933f46091f555e5b7f918cb164eabfba77a131af2c92e37e3402c58
SSDEEP

12288:FEnnhoUxDJKzPNZeO+2HBtIEMt/4FylEQKvC9ss+jJwdmDHif/uuhbJ2XyiCyai:JQaZx+2jIE0/jGgPghTspJ2kyn

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118mgr.exe

pid process

300 1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118mgr.exe
Loads dropped DLL 2 IoCs

Processes:

1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe

pid process

2192 1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192 1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral1/memory/2192-1-0x0000000000400000-0x00000000004E2000-memory.dmp upx
behavioral1/memory/2192-18-0x0000000000400000-0x00000000004E2000-memory.dmp upx
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe

pid process

2192 1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe

pid	process
300	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118mgr.exe

resource	yara_rule
behavioral1/memory/2192-1-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral1/memory/2192-18-0x0000000000400000-0x00000000004E2000-memory.dmp	upx

Suspicious behavior: MapViewOfSection 23 IoCs

Processes:

1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe

pid	process
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2192 1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe

pid process

2192 1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe

description	pid	process	target process
PID 2192 wrote to memory of 300	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118mgr.exe
PID 2192 wrote to memory of 300	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118mgr.exe
PID 2192 wrote to memory of 300	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118mgr.exe
PID 2192 wrote to memory of 300	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118mgr.exe
PID 2192 wrote to memory of 384	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	wininit.exe
PID 2192 wrote to memory of 384	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	wininit.exe
PID 2192 wrote to memory of 384	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	wininit.exe
PID 2192 wrote to memory of 384	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	wininit.exe
PID 2192 wrote to memory of 384	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	wininit.exe
PID 2192 wrote to memory of 384	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	wininit.exe
PID 2192 wrote to memory of 384	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	wininit.exe
PID 2192 wrote to memory of 392	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	csrss.exe
PID 2192 wrote to memory of 392	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	csrss.exe
PID 2192 wrote to memory of 392	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	csrss.exe
PID 2192 wrote to memory of 392	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	csrss.exe
PID 2192 wrote to memory of 392	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	csrss.exe
PID 2192 wrote to memory of 392	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	csrss.exe
PID 2192 wrote to memory of 392	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	csrss.exe
PID 2192 wrote to memory of 432	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	winlogon.exe
PID 2192 wrote to memory of 432	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	winlogon.exe
PID 2192 wrote to memory of 432	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	winlogon.exe
PID 2192 wrote to memory of 432	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	winlogon.exe
PID 2192 wrote to memory of 432	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	winlogon.exe
PID 2192 wrote to memory of 432	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	winlogon.exe
PID 2192 wrote to memory of 432	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	winlogon.exe
PID 2192 wrote to memory of 476	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	services.exe
PID 2192 wrote to memory of 476	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	services.exe
PID 2192 wrote to memory of 476	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	services.exe
PID 2192 wrote to memory of 476	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	services.exe
PID 2192 wrote to memory of 476	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	services.exe
PID 2192 wrote to memory of 476	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	services.exe
PID 2192 wrote to memory of 476	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	services.exe
PID 2192 wrote to memory of 492	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsass.exe
PID 2192 wrote to memory of 492	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsass.exe
PID 2192 wrote to memory of 492	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsass.exe
PID 2192 wrote to memory of 492	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsass.exe
PID 2192 wrote to memory of 492	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsass.exe
PID 2192 wrote to memory of 492	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsass.exe
PID 2192 wrote to memory of 492	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsass.exe
PID 2192 wrote to memory of 500	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsm.exe
PID 2192 wrote to memory of 500	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsm.exe
PID 2192 wrote to memory of 500	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsm.exe
PID 2192 wrote to memory of 500	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsm.exe
PID 2192 wrote to memory of 500	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsm.exe
PID 2192 wrote to memory of 500	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsm.exe
PID 2192 wrote to memory of 500	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	lsm.exe
PID 2192 wrote to memory of 616	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 616	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 616	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 616	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 616	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 616	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 616	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 696	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 696	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 696	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 696	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 696	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 696	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 696	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 764	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 764	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 764	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe
PID 2192 wrote to memory of 764	2192	1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe	svchost.exe

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:616

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
4⤵
PID:1612

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
4⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:836

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:304

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1100

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
3⤵
PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
3⤵
PID:2096

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
3⤵
PID:1600

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:492

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1072

C:\Users\Admin\AppData\Local\Temp\1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192

C:\Users\Admin\AppData\Local\Temp\1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118mgr.exe
C:\Users\Admin\AppData\Local\Temp\1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118mgr.exe
3⤵
- Executes dropped EXE
PID:300

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\1a4e0616d3bb6faaae67c2b9655b3691_JaffaCakes118mgr.exe
Filesize
650KB

MD5
3a713d8ea4721bffcf9eddf47af0dbe5

SHA1
f1ce15d0c816d290885ca9b97b2c7f6f8728647b

SHA256
43a70a7c64ebf6dcaca4d415c4ccb19a9fe82fa15077c00c28e73119451772bd

SHA512
04e7ea8dc5583c9630ada5758b3f37f602d79a0a0c32d46be07efb35de19b1e04d00f220c655a42b2f79687d64e466ae2c8b0e1f4b8b186b835e1d9e1d59e80f

Download Submit
memory/300-13-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

Filesize
48KB

Download
memory/300-12-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/300-11-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2192-1-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/2192-10-0x00000000002B0000-0x0000000000360000-memory.dmp

Filesize
704KB

Download
memory/2192-15-0x0000000077500000-0x0000000077501000-memory.dmp

Filesize
4KB

Download
memory/2192-14-0x00000000774FF000-0x0000000077500000-memory.dmp

Filesize
4KB

Download
memory/2192-4-0x00000000002B0000-0x0000000000360000-memory.dmp

Filesize
704KB

Download
memory/2192-18-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download