Analysis
-
max time kernel
7s -
max time network
8s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-04-2024 00:53
Behavioral task
behavioral1
Sample
ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe
Resource
win7-20240221-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe
Resource
win10v2004-20240226-en
6 signatures
150 seconds
General
-
Target
ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe
-
Size
160KB
-
MD5
ab43217f4d1f579ece7f41004f9592ee
-
SHA1
4e319b658d5bf81575c542cb690c6d54679bd917
-
SHA256
b00f2544b701d64e4fab888c93c2121e846a67b9f98a84713f2f03f5acda92a2
-
SHA512
0e1dd70713bb028f7f0032223099eff07a67d79e88e4f4db82a212e32b1a4fb482dfa10e6248322d9e9f18d352f3beb2b3b9d120bb5144f68dcb52443e4d567f
-
SSDEEP
1536:TEY+mFM2HXKZgi0Iksu+XM5/HtAQ9J6xph:QY+4MiIkLZJNAQ9J6v
Score
10/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2648-0-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C06B3397 = "C:\\Users\\Admin\\AppData\\Roaming\\C06B3397\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
winver.exepid process 1504 winver.exe 1504 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 1504 winver.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exewinver.exedescription pid process target process PID 2648 wrote to memory of 1504 2648 ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe winver.exe PID 2648 wrote to memory of 1504 2648 ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe winver.exe PID 2648 wrote to memory of 1504 2648 ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe winver.exe PID 2648 wrote to memory of 1504 2648 ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe winver.exe PID 1504 wrote to memory of 3428 1504 winver.exe Explorer.EXE PID 1504 wrote to memory of 2768 1504 winver.exe sihost.exe PID 1504 wrote to memory of 2844 1504 winver.exe svchost.exe PID 1504 wrote to memory of 2912 1504 winver.exe taskhostw.exe PID 1504 wrote to memory of 3428 1504 winver.exe Explorer.EXE
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2844
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2912
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ab43217f4d1f579ece7f41004f9592ee_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1504