Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 14:50
Static task
static1
Behavioral task
behavioral1
Sample
8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe
-
Size
339KB
-
MD5
8f80a4323cf7b0d9bb90bc833b4ff8be
-
SHA1
79c5afdfcf805cfcc9bf67307678e4dc1ea00ff1
-
SHA256
31e3f9184e29f3979f4d44b4ee84e806fd45e899a61e40b3d1b11dcd6d79a7ad
-
SHA512
a48bcb5e6e62d48e24d067dceccb0739cbc384b8856b032dac5396df70f2c81b93c2c4cce5c0d9b3774c88dffc16d41ffdde2b62e4e38a91e84108769ec9d40a
-
SSDEEP
3072:BrLcIvLytiVp3iEWr7ZVIBN42AmbYxhIfsex8taNLP2FFEpKvGiukaq8zFrdN4Dy:tNy9Xw7nMC0eOaBPiCpTiukaHz1kpr
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2020
http://gmpeople.com/upload/
http://mile48.com/upload/
http://lecanardstsornin.com/upload/
http://m3600.com/upload/
http://camasirx.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1364 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exepid process 2248 8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe 2248 8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exepid process 2248 8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1364-4-0x00000000025B0000-0x00000000025C5000-memory.dmpFilesize
84KB
-
memory/2248-1-0x0000000001870000-0x0000000001970000-memory.dmpFilesize
1024KB
-
memory/2248-2-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/2248-3-0x0000000000400000-0x00000000016C8000-memory.dmpFilesize
18.8MB
-
memory/2248-5-0x0000000000400000-0x00000000016C8000-memory.dmpFilesize
18.8MB
-
memory/2248-8-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB