Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04-04-2024 11:40
Static task
static1
Behavioral task
behavioral1
Sample
b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exe
-
Size
88KB
-
MD5
b7620b6adf5f0bd58d84f7cde0e3dcfb
-
SHA1
a20820d463caece8930917c193d2c344049740d3
-
SHA256
8a3c975f041bcec99b0495f9e67366b68baac6d0c5deb11dd11a77270892befe
-
SHA512
f40511b157528f234cea14bea4b9357ec913ebde8fe2245c6a6e646433d1cc5581d3f5178f3c3b2c569dcf38d0a1a415dbd7abfe3d60f033ea74ebba25dc12e9
-
SSDEEP
1536:v5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:v5fvp12UFKcD/6jwqWsN
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\4BF86276 = "C:\\Users\\Admin\\AppData\\Roaming\\4BF86276\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid process 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe 840 winver.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
winver.exeExplorer.EXEpid process 840 winver.exe 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exewinver.exedescription pid process target process PID 2848 wrote to memory of 840 2848 b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exe winver.exe PID 2848 wrote to memory of 840 2848 b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exe winver.exe PID 2848 wrote to memory of 840 2848 b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exe winver.exe PID 2848 wrote to memory of 840 2848 b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exe winver.exe PID 2848 wrote to memory of 840 2848 b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exe winver.exe PID 840 wrote to memory of 1380 840 winver.exe Explorer.EXE PID 840 wrote to memory of 1248 840 winver.exe taskhost.exe PID 840 wrote to memory of 1332 840 winver.exe Dwm.exe PID 840 wrote to memory of 1380 840 winver.exe Explorer.EXE
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1248
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1332
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:840