Resubmissions
18-12-2024 12:31
241218-pqhc6azpgj 1031-03-2024 17:58
240331-wkllysgh26 1031-03-2024 17:57
240331-wjnd6agb9w 1031-03-2024 17:52
240331-wf31fagb5w 10Analysis
-
max time kernel
113s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2024 17:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59ff7d1e5dc67270e6a629fc87da34ba_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
59ff7d1e5dc67270e6a629fc87da34ba_JaffaCakes118.exe
-
Size
562KB
-
MD5
59ff7d1e5dc67270e6a629fc87da34ba
-
SHA1
525c41353cc2f5706fabe834475efb6227c6851b
-
SHA256
2e3feb8726d2fa679dd5958baacd7251ada0605bb3a7884aff2f564a8e8ed352
-
SHA512
11845b7e59595f635cd2dce4c04b69b177405403ac66c20668894dd09978858ac9c88dbb14282b5d3f31c8e78d1384f8be41b51de6c968d0b8f47c6a8b562c7a
-
SSDEEP
12288:NmywsrYuTY4TIYm7gPwI7IpnQzAw298ONmvEFe8KHOx5:AyxYEIYJPd7qQzO6ONxA
Malware Config
Signatures
-
Raccoon Stealer V1 payload 5 IoCs
resource yara_rule behavioral2/memory/1284-2-0x0000000003440000-0x00000000034CE000-memory.dmp family_raccoon_v1 behavioral2/memory/1284-3-0x0000000000400000-0x00000000016FF000-memory.dmp family_raccoon_v1 behavioral2/memory/1284-4-0x0000000000400000-0x00000000016FF000-memory.dmp family_raccoon_v1 behavioral2/memory/1284-5-0x0000000000400000-0x00000000016FF000-memory.dmp family_raccoon_v1 behavioral2/memory/1284-8-0x0000000003440000-0x00000000034CE000-memory.dmp family_raccoon_v1 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 228 taskmgr.exe Token: SeSystemProfilePrivilege 228 taskmgr.exe Token: SeCreateGlobalPrivilege 228 taskmgr.exe Token: SeSecurityPrivilege 228 taskmgr.exe Token: SeTakeOwnershipPrivilege 228 taskmgr.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe -
Suspicious use of SendNotifyMessage 43 IoCs
pid Process 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\59ff7d1e5dc67270e6a629fc87da34ba_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\59ff7d1e5dc67270e6a629fc87da34ba_JaffaCakes118.exe"1⤵PID:1284
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5240 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:1216
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:228
-
C:\Windows\System32\_iyiwy.exe"C:\Windows\System32\_iyiwy.exe"1⤵PID:2796