Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
03-04-2024 05:38
Static task
static1
Behavioral task
behavioral1
Sample
a18b856289855086c6208db3507c3351_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a18b856289855086c6208db3507c3351_JaffaCakes118.exe
Resource
win10v2004-20240319-en
General
-
Target
a18b856289855086c6208db3507c3351_JaffaCakes118.exe
-
Size
316KB
-
MD5
a18b856289855086c6208db3507c3351
-
SHA1
44f46bd5f2507d2c62f66b72f8e224d37ecf7b18
-
SHA256
c343d983164eed9615694c3cca990acd7c82c908f04b61005eaeffc0080bf11a
-
SHA512
877c6f4506653cc471a2e7af4245f81367ea7e4b99106ced3daa3817d982039d5d1387bad9990933ae41e292aec15a988b4183e82cdc66ce96d83a502ee80f1f
-
SSDEEP
6144:jEzOzivF/3w2M0GqCA0y5481BsmqlM1kKd:Q7ZoJA0y54wsmql+
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1196 -
Executes dropped EXE 1 IoCs
Processes:
ahbuiripid process 356 ahbuiri -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a18b856289855086c6208db3507c3351_JaffaCakes118.exeahbuiridescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a18b856289855086c6208db3507c3351_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a18b856289855086c6208db3507c3351_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a18b856289855086c6208db3507c3351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ahbuiri Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ahbuiri Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ahbuiri -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a18b856289855086c6208db3507c3351_JaffaCakes118.exepid process 2060 a18b856289855086c6208db3507c3351_JaffaCakes118.exe 2060 a18b856289855086c6208db3507c3351_JaffaCakes118.exe 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 1196 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
a18b856289855086c6208db3507c3351_JaffaCakes118.exeahbuiripid process 2060 a18b856289855086c6208db3507c3351_JaffaCakes118.exe 356 ahbuiri -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1196 1196 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1196 1196 -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 2696 wrote to memory of 356 2696 taskeng.exe ahbuiri PID 2696 wrote to memory of 356 2696 taskeng.exe ahbuiri PID 2696 wrote to memory of 356 2696 taskeng.exe ahbuiri PID 2696 wrote to memory of 356 2696 taskeng.exe ahbuiri -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a18b856289855086c6208db3507c3351_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a18b856289855086c6208db3507c3351_JaffaCakes118.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2060
-
C:\Windows\system32\taskeng.exetaskeng.exe {783B26D8-4F56-4C94-8B1E-9CC309182782} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Roaming\ahbuiriC:\Users\Admin\AppData\Roaming\ahbuiri2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ahbuiriFilesize
316KB
MD5a18b856289855086c6208db3507c3351
SHA144f46bd5f2507d2c62f66b72f8e224d37ecf7b18
SHA256c343d983164eed9615694c3cca990acd7c82c908f04b61005eaeffc0080bf11a
SHA512877c6f4506653cc471a2e7af4245f81367ea7e4b99106ced3daa3817d982039d5d1387bad9990933ae41e292aec15a988b4183e82cdc66ce96d83a502ee80f1f
-
memory/356-14-0x0000000002F00000-0x0000000003000000-memory.dmpFilesize
1024KB
-
memory/356-15-0x0000000000400000-0x0000000002DA7000-memory.dmpFilesize
41.7MB
-
memory/356-19-0x0000000000400000-0x0000000002DA7000-memory.dmpFilesize
41.7MB
-
memory/1196-4-0x0000000003E10000-0x0000000003E26000-memory.dmpFilesize
88KB
-
memory/1196-16-0x0000000003E40000-0x0000000003E56000-memory.dmpFilesize
88KB
-
memory/2060-1-0x0000000002F20000-0x0000000003020000-memory.dmpFilesize
1024KB
-
memory/2060-2-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/2060-3-0x0000000000400000-0x0000000002DA7000-memory.dmpFilesize
41.7MB
-
memory/2060-5-0x0000000000400000-0x0000000002DA7000-memory.dmpFilesize
41.7MB