Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 09:59
Static task
static1
Behavioral task
behavioral1
Sample
1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe
-
Size
740KB
-
MD5
1f104b823c9ac140f99dee39536db4e0
-
SHA1
1551da1ade3252b446d7a7d80295697138859c50
-
SHA256
a4d3c825a4ec99bcac7e75cecfb3f837c5b4c752c9ee49a070193fcf5221c9bf
-
SHA512
f124db7fce940fd31ab99d4dfb9adafa1d24da985c976136e96637267146cb310d39b79382e447fff07f142b40dbb2c5c731d180e739ea8e6b0e507e618a8e30
-
SSDEEP
12288:P2ghLvPhXpe3Plf/X+tGrn33gUdCjIXjT6rrqX8lb7LMsHPEibTxzGmlFQJBk:BXhZgPlfrrAU4jprrjH3HJFz9+e
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
infopdf.sfx.exeinfo pdf.exepid process 2456 infopdf.sfx.exe 2948 info pdf.exe -
Loads dropped DLL 5 IoCs
Processes:
cmd.exeinfopdf.sfx.exepid process 2864 cmd.exe 2456 infopdf.sfx.exe 2456 infopdf.sfx.exe 2456 infopdf.sfx.exe 2456 infopdf.sfx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
info pdf.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe" info pdf.exe -
Processes:
info pdf.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA info pdf.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
Processes:
flow ioc 2 6.tcp.ngrok.io 4 6.tcp.ngrok.io 8 6.tcp.ngrok.io 13 6.tcp.ngrok.io 15 6.tcp.ngrok.io 17 6.tcp.ngrok.io 22 6.tcp.ngrok.io 24 6.tcp.ngrok.io -
Drops file in Program Files directory 2 IoCs
Processes:
info pdf.exedescription ioc process File created C:\Program Files (x86)\TCP Service\tcpsv.exe info pdf.exe File opened for modification C:\Program Files (x86)\TCP Service\tcpsv.exe info pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1968 schtasks.exe 1928 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
info pdf.exepid process 2948 info pdf.exe 2948 info pdf.exe 2948 info pdf.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
info pdf.exepid process 2948 info pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
info pdf.exedescription pid process Token: SeDebugPrivilege 2948 info pdf.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.execmd.exeinfopdf.sfx.exeinfo pdf.exedescription pid process target process PID 1960 wrote to memory of 2864 1960 1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe cmd.exe PID 1960 wrote to memory of 2864 1960 1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe cmd.exe PID 1960 wrote to memory of 2864 1960 1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe cmd.exe PID 1960 wrote to memory of 2864 1960 1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe cmd.exe PID 2864 wrote to memory of 2456 2864 cmd.exe infopdf.sfx.exe PID 2864 wrote to memory of 2456 2864 cmd.exe infopdf.sfx.exe PID 2864 wrote to memory of 2456 2864 cmd.exe infopdf.sfx.exe PID 2864 wrote to memory of 2456 2864 cmd.exe infopdf.sfx.exe PID 2456 wrote to memory of 2948 2456 infopdf.sfx.exe info pdf.exe PID 2456 wrote to memory of 2948 2456 infopdf.sfx.exe info pdf.exe PID 2456 wrote to memory of 2948 2456 infopdf.sfx.exe info pdf.exe PID 2456 wrote to memory of 2948 2456 infopdf.sfx.exe info pdf.exe PID 2948 wrote to memory of 1968 2948 info pdf.exe schtasks.exe PID 2948 wrote to memory of 1968 2948 info pdf.exe schtasks.exe PID 2948 wrote to memory of 1968 2948 info pdf.exe schtasks.exe PID 2948 wrote to memory of 1968 2948 info pdf.exe schtasks.exe PID 2948 wrote to memory of 1928 2948 info pdf.exe schtasks.exe PID 2948 wrote to memory of 1928 2948 info pdf.exe schtasks.exe PID 2948 wrote to memory of 1928 2948 info pdf.exe schtasks.exe PID 2948 wrote to memory of 1928 2948 info pdf.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\inf.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\infopdf.sfx.exeinfopdf.sfx.exe -pbara -dC:\Users\Admin\AppData\Roaming3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\info pdf.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\info pdf.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp406.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp511.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\inf.batFilesize
36B
MD5934627ff4a68a982fa6804cb94c3dfa3
SHA1de095d8190f945384e1a801f2c800d40d4fd3612
SHA25638133ed3a3fba9525559006d0338baa897f7889a6149371d1daae30e3ce6dd06
SHA512e5277ca8c0a082207612101450f73a5d60bbf48256faa975645394aa3eda96147a0f4ec6822f0992bd26029eeb58ea1eb29c5805bfcc9715829562e9a024e12d
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\info pdf.exeFilesize
431KB
MD5d43d29275fb37b0f267e09235f8a6796
SHA1816ef7e3993c2c9a88829fa34eda6d3495044b86
SHA256729c2c1508855eee3acee4055dc7ea2f4a17d97b6eb0ca903fd24720dfd7f2b0
SHA51227bafd46aafdce0db91700bc8995e55958693a17f9938f3f94e7c6230a472723faaee6a10d07ad2e50237abd3a7211d4ad171b8492adfbca07dafcee4bdb0c04
-
C:\Users\Admin\AppData\Local\Temp\tmp406.tmpFilesize
1KB
MD52d19ad7392f7f5d0c9cfd97dfc77f73a
SHA1e4f9fe47a8ccbedd509e608dfcec29216da1288f
SHA2568cbdcb135a0503b74a0774d5dc660f927f39681491f0dd0ce3762a0005e2e7aa
SHA512672511f97c7ba0e7dfc106c343dcbadfdb838f9987ba876e6b5ac936ef33fe91186b5d5ab0bce3c9c0e0178b59b12711bcf9977c65099df891c25efb547ef1dc
-
C:\Users\Admin\AppData\Local\Temp\tmp511.tmpFilesize
1KB
MD593fc3117767507c9889abd12dc667d22
SHA11096e4cfa0c35756e3c3fb866c1e4c1e59115df9
SHA256684997dd4ce15031cec8f2f93933b1d41d7bf5cbbff655dd64377b07055c449a
SHA512e403348ee77bd3e7c45245dd5dae81c3ea130d5cf342f630982772ce5f75548b292013480e2831d68cf51349b64afde4589d4eec94b567d20f0a01e3b9549bdc
-
\Users\Admin\AppData\Local\Temp\RarSFX0\infopdf.sfx.exeFilesize
580KB
MD5e91a7d804e54dc53e026f56e3e45961c
SHA1a045896bbe4797cd80890c17b23cd29bbdc9beab
SHA256350a690a878fc026118975c88170de5aa73f42d2b514ce749f68e95bbbb01858
SHA512c07c8ce06dc322d7c6f7d401f7906dcfdf0e7af7fce99c7c455d6668be97501a45d9a4b4443e2abb361fb7b206b2411eb45f8cd81909e388a2a0bcf68f12ccf0
-
memory/2948-41-0x0000000000280000-0x00000000002C0000-memory.dmpFilesize
256KB
-
memory/2948-40-0x0000000074580000-0x0000000074B2B000-memory.dmpFilesize
5.7MB
-
memory/2948-38-0x0000000074580000-0x0000000074B2B000-memory.dmpFilesize
5.7MB
-
memory/2948-39-0x0000000000280000-0x00000000002C0000-memory.dmpFilesize
256KB
-
memory/2948-50-0x0000000000280000-0x00000000002C0000-memory.dmpFilesize
256KB
-
memory/2948-49-0x0000000074580000-0x0000000074B2B000-memory.dmpFilesize
5.7MB
-
memory/2948-51-0x0000000000280000-0x00000000002C0000-memory.dmpFilesize
256KB
-
memory/2948-52-0x0000000000280000-0x00000000002C0000-memory.dmpFilesize
256KB