Resubmissions
18/12/2024, 12:31
241218-pqhc6azpgj1031/03/2024, 17:58
240331-wkllysgh261031/03/2024, 17:57
240331-wjnd6agb9w1031/03/2024, 17:52
240331-wf31fagb5w10Analysis
- max time kernel
113s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
31/03/2024, 17:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59ff7d1e5dc67270e6a629fc87da34ba_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
- Target 59ff7d1e5dc67270e6a629fc87da34ba_JaffaCakes118.exe
- Size 562KB
- Sample240331-wkllysgh26
- SHA256 2e3feb8726d2fa679dd5958baacd7251ada0605bb3a7884aff2f564a8e8ed352
- MD5 59ff7d1e5dc67270e6a629fc87da34ba
- SHA1 525c41353cc2f5706fabe834475efb6227c6851b
- SHA512 11845b7e59595f635cd2dce4c04b69b177405403ac66c20668894dd09978858ac9c88dbb14282b5d3f31c8e78d1384f8be41b51de6c968d0b8f47c6a8b562c7a
- SSDEEP 12288:NmywsrYuTY4TIYm7gPwI7IpnQzAw298ONmvEFe8KHOx5:AyxYEIYJPd7qQzO6ONxA
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Raccoon Stealer V1 payload 5 IoCs
resource yara_rule behavioral2/memory/1284-2-0x0000000003440000-0x00000000034CE000-memory.dmp family_raccoon_v1 behavioral2/memory/1284-3-0x0000000000400000-0x00000000016FF000-memory.dmp family_raccoon_v1 behavioral2/memory/1284-4-0x0000000000400000-0x00000000016FF000-memory.dmp family_raccoon_v1 behavioral2/memory/1284-5-0x0000000000400000-0x00000000016FF000-memory.dmp family_raccoon_v1 behavioral2/memory/1284-8-0x0000000003440000-0x00000000034CE000-memory.dmp family_raccoon_v1 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 228 taskmgr.exe Token: SeSystemProfilePrivilege 228 taskmgr.exe Token: SeCreateGlobalPrivilege 228 taskmgr.exe Token: SeSecurityPrivilege 228 taskmgr.exe Token: SeTakeOwnershipPrivilege 228 taskmgr.exe - Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe - Suspicious use of SendNotifyMessage 43 IoCs
pid Process 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\59ff7d1e5dc67270e6a629fc87da34ba_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\59ff7d1e5dc67270e6a629fc87da34ba_JaffaCakes118.exe"1⤵PID:1284
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5240 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:1216
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:228
-
C:\Windows\System32\_iyiwy.exe"C:\Windows\System32\_iyiwy.exe"1⤵PID:2796