Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-04-2024 08:21
Behavioral task
behavioral1
Sample
b36903144bd32c1090633fcc056ff11d_JaffaCakes118.exe
Resource
win7-20240221-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
b36903144bd32c1090633fcc056ff11d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
9 signatures
150 seconds
General
-
Target
b36903144bd32c1090633fcc056ff11d_JaffaCakes118.exe
-
Size
34KB
-
MD5
b36903144bd32c1090633fcc056ff11d
-
SHA1
5dda87571d683cfc5b1953011acbf21a3d195471
-
SHA256
c4ac111d3acbe526568ac988170d1fb0c0be4869ded07b650c74e1e77588c27f
-
SHA512
0f91c7a2775e6abefe57dfdab788c9ed72bd9ec06ded6fec9e954fd5c3a0a663e76d6def5cf343caf61952577460c6e2e3c44dae0d64b064581c0b05fb7bc1f6
-
SSDEEP
768:2p22qWFcy5XQ7lO41uirwA98p3MpkNBxd0cJWV6dy/x9J2:2pYoX58z1uirL98xMWnT0OQ9J2
Score
10/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2688-0-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\A0D8DF65 = "C:\\Users\\Admin\\AppData\\Roaming\\A0D8DF65\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid process 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe 3028 winver.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
winver.exeExplorer.EXEpid process 3028 winver.exe 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
b36903144bd32c1090633fcc056ff11d_JaffaCakes118.exewinver.exedescription pid process target process PID 2688 wrote to memory of 3028 2688 b36903144bd32c1090633fcc056ff11d_JaffaCakes118.exe winver.exe PID 2688 wrote to memory of 3028 2688 b36903144bd32c1090633fcc056ff11d_JaffaCakes118.exe winver.exe PID 2688 wrote to memory of 3028 2688 b36903144bd32c1090633fcc056ff11d_JaffaCakes118.exe winver.exe PID 2688 wrote to memory of 3028 2688 b36903144bd32c1090633fcc056ff11d_JaffaCakes118.exe winver.exe PID 2688 wrote to memory of 3028 2688 b36903144bd32c1090633fcc056ff11d_JaffaCakes118.exe winver.exe PID 3028 wrote to memory of 1412 3028 winver.exe Explorer.EXE PID 3028 wrote to memory of 1236 3028 winver.exe taskhost.exe PID 3028 wrote to memory of 1324 3028 winver.exe Dwm.exe PID 3028 wrote to memory of 1412 3028 winver.exe Explorer.EXE
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1236
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1324
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\b36903144bd32c1090633fcc056ff11d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b36903144bd32c1090633fcc056ff11d_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3028