26d1b03adfe0bcd81726c84368eb34974e15c2ba86c515db56b39658f1c4b7f1

Analysis

max time kernel
147s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe
Size

123KB
MD5

1b2db236bc601e5bcfb37e75133d5f68
SHA1

429111ae13b49e9a127d7d8a5f319a7207110bc0
SHA256

26d1b03adfe0bcd81726c84368eb34974e15c2ba86c515db56b39658f1c4b7f1
SHA512

534e42b1daf2acb50a68cdfa727b22f3a1b991c8eaa9abf34e62600496a1c92b7292bcb19caef54795c08ed2ded40ba6079e151909ab816520baf259fef36c95
SSDEEP

3072:xdbT6SQtLbaJAgn2JIJnDSBloRyQ4uB1lIou+Pzn:xdf6SQt/aJAbIJ6EyQ4OIou+b

Score

7^/10

aspackv2 vmprotect

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
aspackv2

Processes:

resource yara_rule

C:\Windows\YiQLtNO.exe aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\Com1BDB.tmp aspack_v212_v242
Executes dropped EXE 1 IoCs

Processes:

YiQLtNO.exe

pid process

2984 YiQLtNO.exe
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\Com1BDB.tmp vmprotect

resource	yara_rule
C:\Windows\YiQLtNO.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\Com1BDB.tmp	aspack_v212_v242

pid	process
2984	YiQLtNO.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Com1BDB.tmp	vmprotect

Drops file in System32 directory 7 IoCs

Processes:

1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ucJOQ.nYY	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mshtml.dll	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DllCache\mshtml.dllucJOQ	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DllCache\mshtml.dll	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mshtml.dllucJOQ	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mshtml.dll.mod	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mshtml.dll.mod	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

Processes:

1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe
File created	C:\Windows\YiQLtNO.exe	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe
File opened for modification	C:\Windows\YiQLtNO.exe	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2676 2964 WerFault.exe 1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe

pid process

2964 1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe

pid	pid_target	process	target process
2676	2964	WerFault.exe	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe

pid	process
2964	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe

description	pid	process	target process
PID 2964 wrote to memory of 2984	2964	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe	YiQLtNO.exe
PID 2964 wrote to memory of 2984	2964	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe	YiQLtNO.exe
PID 2964 wrote to memory of 2984	2964	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe	YiQLtNO.exe
PID 2964 wrote to memory of 2984	2964	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe	YiQLtNO.exe
PID 2964 wrote to memory of 2676	2964	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe	WerFault.exe
PID 2964 wrote to memory of 2676	2964	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe	WerFault.exe
PID 2964 wrote to memory of 2676	2964	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe	WerFault.exe
PID 2964 wrote to memory of 2676	2964	1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b2db236bc601e5bcfb37e75133d5f68_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\YiQLtNO.exe
"C:\Windows\YiQLtNO.exe"
2⤵
- Executes dropped EXE
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 344
2⤵
- Program crash
PID:2676

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Com1BDB.tmp
Filesize
59KB

MD5
0b1753074a4950710e9d6a6bbf6103e0

SHA1
3e8b33229da9417225d879245fd79741e4099277

SHA256
2434ac43e1b6389d7c7ae22910f75d6f360033497093e2bdcdacf42b569922dd

SHA512
89428da44ae7d9d54ba5b3199550892fcc4e8273aa49c3a33d4e911bbac82b93fb92a48e7c24132604c98c47380f4282c84fc114547ecfcbb0112bae14c958f7

Download Submit
C:\Windows\YiQLtNO.exe
Filesize
51KB

MD5
062fae9998838a4f130ab0d62e48aa0d

SHA1
b358cc42a3d0be33ac0fa3b94383d5512fd85ff7

SHA256
8c6d7fdcfee602e7f966e445422fa95d26d744b6331ea76e5337a00d5df2e675

SHA512
5b856371202225e8931351301cbbc22b2b73078448d57070cd068c5fef07435d245a990e5ad68558ba56dbd759d7bbd4ca2d7eb4f4f970882f7d697f191d9037

Download Submit
memory/2964-5-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2964-14-0x00000000003E0000-0x00000000003F8000-memory.dmp

Filesize
96KB

Download
memory/2964-15-0x00000000003E0000-0x00000000003F8000-memory.dmp

Filesize
96KB

Download
memory/2964-26-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2984-17-0x0000000000412000-0x0000000000414000-memory.dmp

Filesize
8KB

Download
memory/2984-16-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2984-13-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2984-12-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads