Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31-03-2024 13:58
Static task
static1
Behavioral task
behavioral1
Sample
564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exe
-
Size
338KB
-
MD5
564d953bf82c6cdd73058d77841e54df
-
SHA1
cc5f8250e3507eea671adcddd30057e9f787e30c
-
SHA256
95131b7d3857e99c14a70e5a6f44c646e55276fe455d5176ea1bd176eb1b992c
-
SHA512
831a0e2adace91e700a6d4f66b350e0e62b87fce4dd666fa789a36c17879f47871e7b20eb8fe359cccf4a091ec5f7c0da529a3fefc64ca044d2e1375fbf557a0
-
SSDEEP
6144:TOZ7BQXkct0u9hh3fxGOOrG1P38A1zE62E7Q61lD:T/0WrPxGOOsPX1462uQ8lD
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2020
http://gmpeople.com/upload/
http://mile48.com/upload/
http://lecanardstsornin.com/upload/
http://m3600.com/upload/
http://camasirx.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1288 -
Executes dropped EXE 1 IoCs
Processes:
fbvuwftpid process 1812 fbvuwft -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exefbvuwftdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fbvuwft Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fbvuwft Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fbvuwft -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exepid process 1680 564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exe 1680 564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exe 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exefbvuwftpid process 1680 564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exe 1812 fbvuwft -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 3048 wrote to memory of 1812 3048 taskeng.exe fbvuwft PID 3048 wrote to memory of 1812 3048 taskeng.exe fbvuwft PID 3048 wrote to memory of 1812 3048 taskeng.exe fbvuwft PID 3048 wrote to memory of 1812 3048 taskeng.exe fbvuwft
Processes
-
C:\Users\Admin\AppData\Local\Temp\564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\564d953bf82c6cdd73058d77841e54df_JaffaCakes118.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {45B2FC59-1B9C-485B-B7CE-41E09EB96773} S-1-5-21-406356229-2805545415-1236085040-1000:IKJSPGIM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\fbvuwftC:\Users\Admin\AppData\Roaming\fbvuwft2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\fbvuwftFilesize
338KB
MD5564d953bf82c6cdd73058d77841e54df
SHA1cc5f8250e3507eea671adcddd30057e9f787e30c
SHA25695131b7d3857e99c14a70e5a6f44c646e55276fe455d5176ea1bd176eb1b992c
SHA512831a0e2adace91e700a6d4f66b350e0e62b87fce4dd666fa789a36c17879f47871e7b20eb8fe359cccf4a091ec5f7c0da529a3fefc64ca044d2e1375fbf557a0
-
memory/1288-4-0x0000000002200000-0x0000000002215000-memory.dmpFilesize
84KB
-
memory/1288-16-0x0000000002C40000-0x0000000002C55000-memory.dmpFilesize
84KB
-
memory/1680-1-0x0000000001790000-0x0000000001890000-memory.dmpFilesize
1024KB
-
memory/1680-2-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1680-3-0x0000000000400000-0x00000000016C8000-memory.dmpFilesize
18.8MB
-
memory/1680-5-0x0000000000400000-0x00000000016C8000-memory.dmpFilesize
18.8MB
-
memory/1812-14-0x0000000001840000-0x0000000001940000-memory.dmpFilesize
1024KB
-
memory/1812-15-0x0000000000400000-0x00000000016C8000-memory.dmpFilesize
18.8MB
-
memory/1812-17-0x0000000000400000-0x00000000016C8000-memory.dmpFilesize
18.8MB