Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-04-2024 00:53
Behavioral task
behavioral1
Sample
ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe
Resource
win7-20240221-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe
Resource
win10v2004-20240226-en
6 signatures
150 seconds
General
-
Target
ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe
-
Size
160KB
-
MD5
ab43217f4d1f579ece7f41004f9592ee
-
SHA1
4e319b658d5bf81575c542cb690c6d54679bd917
-
SHA256
b00f2544b701d64e4fab888c93c2121e846a67b9f98a84713f2f03f5acda92a2
-
SHA512
0e1dd70713bb028f7f0032223099eff07a67d79e88e4f4db82a212e32b1a4fb482dfa10e6248322d9e9f18d352f3beb2b3b9d120bb5144f68dcb52443e4d567f
-
SSDEEP
1536:TEY+mFM2HXKZgi0Iksu+XM5/HtAQ9J6xph:QY+4MiIkLZJNAQ9J6v
Score
10/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1740-0-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\D26780F4 = "C:\\Users\\Admin\\AppData\\Roaming\\D26780F4\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid process 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe 2584 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2584 winver.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exewinver.exedescription pid process target process PID 1740 wrote to memory of 2584 1740 ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe winver.exe PID 1740 wrote to memory of 2584 1740 ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe winver.exe PID 1740 wrote to memory of 2584 1740 ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe winver.exe PID 1740 wrote to memory of 2584 1740 ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe winver.exe PID 1740 wrote to memory of 2584 1740 ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe winver.exe PID 2584 wrote to memory of 1244 2584 winver.exe Explorer.EXE PID 2584 wrote to memory of 1116 2584 winver.exe taskhost.exe PID 2584 wrote to memory of 1180 2584 winver.exe Dwm.exe PID 2584 wrote to memory of 1244 2584 winver.exe Explorer.EXE
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2584