Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 14:50
Static task
static1
Behavioral task
behavioral1
Sample
8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe
-
Size
339KB
-
MD5
8f80a4323cf7b0d9bb90bc833b4ff8be
-
SHA1
79c5afdfcf805cfcc9bf67307678e4dc1ea00ff1
-
SHA256
31e3f9184e29f3979f4d44b4ee84e806fd45e899a61e40b3d1b11dcd6d79a7ad
-
SHA512
a48bcb5e6e62d48e24d067dceccb0739cbc384b8856b032dac5396df70f2c81b93c2c4cce5c0d9b3774c88dffc16d41ffdde2b62e4e38a91e84108769ec9d40a
-
SSDEEP
3072:BrLcIvLytiVp3iEWr7ZVIBN42AmbYxhIfsex8taNLP2FFEpKvGiukaq8zFrdN4Dy:tNy9Xw7nMC0eOaBPiCpTiukaHz1kpr
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2020
http://gmpeople.com/upload/
http://mile48.com/upload/
http://lecanardstsornin.com/upload/
http://m3600.com/upload/
http://camasirx.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3468 -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4452 2764 WerFault.exe 8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exepid process 2764 8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe 2764 8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 3468 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exepid process 2764 8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3468 Token: SeCreatePagefilePrivilege 3468 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3468 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8f80a4323cf7b0d9bb90bc833b4ff8be_JaffaCakes118.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 3682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2764 -ip 27641⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2764-1-0x0000000001860000-0x0000000001960000-memory.dmpFilesize
1024KB
-
memory/2764-2-0x0000000001820000-0x0000000001829000-memory.dmpFilesize
36KB
-
memory/2764-3-0x0000000000400000-0x00000000016C8000-memory.dmpFilesize
18.8MB
-
memory/2764-7-0x0000000000400000-0x00000000016C8000-memory.dmpFilesize
18.8MB
-
memory/3468-4-0x0000000000F20000-0x0000000000F35000-memory.dmpFilesize
84KB