Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 17:45
Static task
static1
Behavioral task
behavioral1
Sample
beb0eae669952040b5a11956f9576b25_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
beb0eae669952040b5a11956f9576b25_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
beb0eae669952040b5a11956f9576b25_JaffaCakes118.exe
-
Size
24KB
-
MD5
beb0eae669952040b5a11956f9576b25
-
SHA1
dc4e7e23837c7fd756136d07e8208aece18baf7d
-
SHA256
2b7c38975c3299b22a69f71f762352fdd87a707dd38cb3b71f914b63e3ddbd2e
-
SHA512
373ef784e60cde7afbda1d84e410d9c811d5b4f299c2c505aa7fb5eb61255324b183af3a789ccc08d17399033d78b14380e6a4a84675449e20a74c68cca7ec75
-
SSDEEP
384:E3eVES+/xwGkRKJD+clM61qmTTMVF9/q5V0:bGS+ZfbJD9O8qYoA6
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" beb0eae669952040b5a11956f9576b25_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe beb0eae669952040b5a11956f9576b25_JaffaCakes118.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 932 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2304 ipconfig.exe 3024 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 932 tasklist.exe Token: SeDebugPrivilege 3024 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1704 beb0eae669952040b5a11956f9576b25_JaffaCakes118.exe 1704 beb0eae669952040b5a11956f9576b25_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1704 wrote to memory of 4684 1704 beb0eae669952040b5a11956f9576b25_JaffaCakes118.exe 86 PID 1704 wrote to memory of 4684 1704 beb0eae669952040b5a11956f9576b25_JaffaCakes118.exe 86 PID 1704 wrote to memory of 4684 1704 beb0eae669952040b5a11956f9576b25_JaffaCakes118.exe 86 PID 4684 wrote to memory of 1628 4684 cmd.exe 88 PID 4684 wrote to memory of 1628 4684 cmd.exe 88 PID 4684 wrote to memory of 1628 4684 cmd.exe 88 PID 4684 wrote to memory of 2304 4684 cmd.exe 90 PID 4684 wrote to memory of 2304 4684 cmd.exe 90 PID 4684 wrote to memory of 2304 4684 cmd.exe 90 PID 4684 wrote to memory of 932 4684 cmd.exe 91 PID 4684 wrote to memory of 932 4684 cmd.exe 91 PID 4684 wrote to memory of 932 4684 cmd.exe 91 PID 4684 wrote to memory of 832 4684 cmd.exe 94 PID 4684 wrote to memory of 832 4684 cmd.exe 94 PID 4684 wrote to memory of 832 4684 cmd.exe 94 PID 832 wrote to memory of 4532 832 net.exe 96 PID 832 wrote to memory of 4532 832 net.exe 96 PID 832 wrote to memory of 4532 832 net.exe 96 PID 4684 wrote to memory of 3024 4684 cmd.exe 97 PID 4684 wrote to memory of 3024 4684 cmd.exe 97 PID 4684 wrote to memory of 3024 4684 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\beb0eae669952040b5a11956f9576b25_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\beb0eae669952040b5a11956f9576b25_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:1628
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2304
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:932
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:4532
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5e79627a414d1481a41d879818f21f614
SHA11cf27c0cc450e4119bf67ee987a33e282a05ea02
SHA2560e03e2ba52fd91d0a82338cf60f80fcfa4c7cac69043105d5db9b587caf1c520
SHA5124d6d4839925b5c76a2ae5a9b78905ab8e556d20b976e952a097c7f3f6dba6e36a69b0940b20a69db09cb71a33a65b04801d493f26caa0598d9cce01ffb62cc17