Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-04-2024 01:47
Static task
static1
Behavioral task
behavioral1
Sample
644eb593c582c716587d69acd23b3982_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
644eb593c582c716587d69acd23b3982_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
644eb593c582c716587d69acd23b3982_JaffaCakes118.exe
-
Size
375KB
-
MD5
644eb593c582c716587d69acd23b3982
-
SHA1
cf575ca1b8c607825f3fa6ffdfeaace315b0fabe
-
SHA256
249b11975db6b600f118671ff5d6bf528d3af34ab137faee493831b1ba49e6b8
-
SHA512
f7bb893d00593d40d61d029b8cbe3b0b588a5dd33c04c1dbf6e28c765e226f630584dc67c72a37eb31023c2494e96846d2cf0227fbef9dc7e78b5a1d4e1b07a2
-
SSDEEP
6144:psGV7bNSqVplixvXvIRI8psKN7k/afOlJs6umAkT:p/RVDixvIpsx/af0pAI
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2020
http://bostoc.com/upload/
http://qianyoupj.cn/upload/
http://sleoppen.com/upload/
http://stempelbeton.at/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1232 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
644eb593c582c716587d69acd23b3982_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 644eb593c582c716587d69acd23b3982_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 644eb593c582c716587d69acd23b3982_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 644eb593c582c716587d69acd23b3982_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
644eb593c582c716587d69acd23b3982_JaffaCakes118.exepid process 2844 644eb593c582c716587d69acd23b3982_JaffaCakes118.exe 2844 644eb593c582c716587d69acd23b3982_JaffaCakes118.exe 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
644eb593c582c716587d69acd23b3982_JaffaCakes118.exepid process 2844 644eb593c582c716587d69acd23b3982_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1232-4-0x0000000002A50000-0x0000000002A66000-memory.dmpFilesize
88KB
-
memory/2844-1-0x0000000001880000-0x0000000001980000-memory.dmpFilesize
1024KB
-
memory/2844-2-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/2844-3-0x0000000000400000-0x00000000016C0000-memory.dmpFilesize
18.8MB
-
memory/2844-5-0x0000000000400000-0x00000000016C0000-memory.dmpFilesize
18.8MB