Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/04/2024, 13:15
Static task
static1
Behavioral task
behavioral1
Sample
b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe
-
Size
7.9MB
-
MD5
b94a1fd6e0773a4eda0fa083249a7b0c
-
SHA1
9534195e2d1defcc6c235074d84ed39067284ce1
-
SHA256
99e865dc90658cdd73de624c8eeda31580a5e11285a4e280a384cd7ccabf2ccf
-
SHA512
ba545bc4be13dc9a7cc3fb0873d7baa4fc45370e4b700e944af9ff65d78c72c2891c6c4402801af2d2eaa00af955c511185b1ed5b62f91e4df2b2f3065407efa
-
SSDEEP
196608:8Kazg7DSmKazg7DSmKazg7DSmKazg7DSN:Eg7u6g7u6g7u6g7uN
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2428 7D57AD13E21.exe 2556 Scegli_nome_allegato.exe 1740 7D57AD13E21.exe -
Loads dropped DLL 3 IoCs
pid Process 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\7D57AD13E21.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2428 set thread context of 1740 2428 7D57AD13E21.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Scegli_nome_allegato.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Scegli_nome_allegato.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main Scegli_nome_allegato.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2616 reg.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2556 Scegli_nome_allegato.exe 2556 Scegli_nome_allegato.exe 2556 Scegli_nome_allegato.exe 1740 7D57AD13E21.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2616 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 28 PID 1924 wrote to memory of 2616 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 28 PID 1924 wrote to memory of 2616 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 28 PID 1924 wrote to memory of 2616 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 28 PID 1924 wrote to memory of 2428 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2428 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2428 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2428 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2556 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 31 PID 1924 wrote to memory of 2556 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 31 PID 1924 wrote to memory of 2556 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 31 PID 1924 wrote to memory of 2556 1924 b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe 31 PID 2428 wrote to memory of 1740 2428 7D57AD13E21.exe 35 PID 2428 wrote to memory of 1740 2428 7D57AD13E21.exe 35 PID 2428 wrote to memory of 1740 2428 7D57AD13E21.exe 35 PID 2428 wrote to memory of 1740 2428 7D57AD13E21.exe 35 PID 2428 wrote to memory of 1740 2428 7D57AD13E21.exe 35 PID 2428 wrote to memory of 1740 2428 7D57AD13E21.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b94a1fd6e0773a4eda0fa083249a7b0c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe" /f2⤵
- Adds Run key to start application
- Modifies registry key
PID:2616
-
-
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1740
-
-
-
C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.9MB
MD56e7f8a44aac68dc3eca425222e88a762
SHA12b76295e6fa9a22813b0fca4ae386a93f044bd76
SHA256d8683655c8a8b3f9e5735d3e167fbb4ca352915a8e2c555504d9a1504ce48194
SHA512d05eb9bf15bde7cbac93fcceef54c93bd64b8836964c7cbcda00e2b81644105b50cc6688139f9b661ce1b4d765369965e9d7696d3e5db5edb9ff9fd7bbbe62de
-
Filesize
1.0MB
MD5a2f259ceb892d3b0d1d121997c8927e3
SHA16e0a7239822b8d365d690a314f231286355f6cc6
SHA256ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
SHA5125ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad