Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/04/2024, 13:26
Static task
static1
Behavioral task
behavioral1
Sample
b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe
-
Size
15.9MB
-
MD5
b97e6ceadb35fc9575cbf741794b2462
-
SHA1
d9c1f1f3372bee8a2189c30651a9deb5a57892b4
-
SHA256
102473af3df3e3a3af680d4bd00e9d329f24dba787147c578ef3f0886f167fb5
-
SHA512
450ae31008c0a5027a1b5f3d91ec568879e903fad1e1bb77334bfe17291dcb70b584f5691aadcddc7a2301108a40adb44f43aa09f92a05063d165e9b70efd0d9
-
SSDEEP
393216:ng7uFg7uFg7uFg7uFg7uFg7uFg7uFg7uN:gSuSuSuSuSuSuSuSN
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2516 7D57AD13E21.exe 2600 Scegli_nome_allegato.exe 2712 7D57AD13E21.exe -
Loads dropped DLL 3 IoCs
pid Process 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\7D57AD13E21.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2516 set thread context of 2712 2516 7D57AD13E21.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Scegli_nome_allegato.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main Scegli_nome_allegato.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Scegli_nome_allegato.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2572 reg.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2600 Scegli_nome_allegato.exe 2600 Scegli_nome_allegato.exe 2600 Scegli_nome_allegato.exe 2712 7D57AD13E21.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2572 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 28 PID 2040 wrote to memory of 2572 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 28 PID 2040 wrote to memory of 2572 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 28 PID 2040 wrote to memory of 2572 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 28 PID 2040 wrote to memory of 2516 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 30 PID 2040 wrote to memory of 2516 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 30 PID 2040 wrote to memory of 2516 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 30 PID 2040 wrote to memory of 2516 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 30 PID 2040 wrote to memory of 2600 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 31 PID 2040 wrote to memory of 2600 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 31 PID 2040 wrote to memory of 2600 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 31 PID 2040 wrote to memory of 2600 2040 b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe 31 PID 2516 wrote to memory of 2712 2516 7D57AD13E21.exe 33 PID 2516 wrote to memory of 2712 2516 7D57AD13E21.exe 33 PID 2516 wrote to memory of 2712 2516 7D57AD13E21.exe 33 PID 2516 wrote to memory of 2712 2516 7D57AD13E21.exe 33 PID 2516 wrote to memory of 2712 2516 7D57AD13E21.exe 33 PID 2516 wrote to memory of 2712 2516 7D57AD13E21.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b97e6ceadb35fc9575cbf741794b2462_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe" /f2⤵
- Adds Run key to start application
- Modifies registry key
PID:2572
-
-
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2712
-
-
-
C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15.9MB
MD57acb3a2b7a3ccf0b610dc9180e24270f
SHA1c4182adc6b678656715bc6bb217a412d35ec0deb
SHA2566f4739459036943ddcc992f207cd0c0458b5908c98d2e92ca78d25b0d0d6d5d7
SHA512181361c888d5370c68b63ec9aa5f2a824cdb4048923155cc3115bcf82f7e4ef3d79f150dbf113059582a71cf8b87318b33382a37a27094f75de262c64ebad542
-
Filesize
1.0MB
MD5a2f259ceb892d3b0d1d121997c8927e3
SHA16e0a7239822b8d365d690a314f231286355f6cc6
SHA256ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
SHA5125ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad