Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31-03-2024 16:08
Static task
static1
Behavioral task
behavioral1
Sample
580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exe
Resource
win10v2004-20240319-en
General
-
Target
580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exe
-
Size
343KB
-
MD5
580fc5cd72d7979040fa1c4866ada3d0
-
SHA1
7da202d99be94f57f355c611bafde9656bca65b7
-
SHA256
42e7ef551c652a5e6f0ff919fcb53cd2c34682006cb1436295205a41abec6589
-
SHA512
b1be0be516e0d36c4b2e2f9e82e5cd94fecc86c39a4eee4494174f55e319a4c72d529e2aa097d3d466c5613df4106624fd689e6a1441e6be4a7bf9a15dc44815
-
SSDEEP
6144:3WbmUi7XUPNWmWPYRCuuWouCd0Oj12zOfG6/ksyfGhQ+J2Y9u/:3WbmUizUPomWQRCvWoumtj1iOfGbs+G6
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1216 -
Executes dropped EXE 1 IoCs
Processes:
ffsacbcpid process 2732 ffsacbc -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ffsacbc580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ffsacbc Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ffsacbc Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ffsacbc -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exepid process 2016 580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exe 2016 580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exe 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exeffsacbcpid process 2016 580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exe 2732 ffsacbc -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 2488 wrote to memory of 2732 2488 taskeng.exe ffsacbc PID 2488 wrote to memory of 2732 2488 taskeng.exe ffsacbc PID 2488 wrote to memory of 2732 2488 taskeng.exe ffsacbc PID 2488 wrote to memory of 2732 2488 taskeng.exe ffsacbc -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\580fc5cd72d7979040fa1c4866ada3d0_JaffaCakes118.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {2E9505DD-7475-4BE7-B1A9-AA7EBC60AA06} S-1-5-21-1658372521-4246568289-2509113762-1000:PIRBKNPS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ffsacbcC:\Users\Admin\AppData\Roaming\ffsacbc2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ffsacbcFilesize
343KB
MD5580fc5cd72d7979040fa1c4866ada3d0
SHA17da202d99be94f57f355c611bafde9656bca65b7
SHA25642e7ef551c652a5e6f0ff919fcb53cd2c34682006cb1436295205a41abec6589
SHA512b1be0be516e0d36c4b2e2f9e82e5cd94fecc86c39a4eee4494174f55e319a4c72d529e2aa097d3d466c5613df4106624fd689e6a1441e6be4a7bf9a15dc44815
-
memory/1216-4-0x0000000002970000-0x0000000002986000-memory.dmpFilesize
88KB
-
memory/1216-16-0x00000000029B0000-0x00000000029C6000-memory.dmpFilesize
88KB
-
memory/2016-1-0x0000000000290000-0x0000000000390000-memory.dmpFilesize
1024KB
-
memory/2016-2-0x00000000001B0000-0x00000000001B9000-memory.dmpFilesize
36KB
-
memory/2016-3-0x0000000000400000-0x0000000000788000-memory.dmpFilesize
3.5MB
-
memory/2016-5-0x0000000000400000-0x0000000000788000-memory.dmpFilesize
3.5MB
-
memory/2732-14-0x0000000000900000-0x0000000000A00000-memory.dmpFilesize
1024KB
-
memory/2732-15-0x0000000000400000-0x0000000000788000-memory.dmpFilesize
3.5MB
-
memory/2732-17-0x0000000000400000-0x0000000000788000-memory.dmpFilesize
3.5MB