Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/04/2024, 17:47
Static task
static1
Behavioral task
behavioral1
Sample
bebe00983a92f88509708b574af4247b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bebe00983a92f88509708b574af4247b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
bebe00983a92f88509708b574af4247b_JaffaCakes118.exe
-
Size
24KB
-
MD5
bebe00983a92f88509708b574af4247b
-
SHA1
9fc97715319a090107702cdef13bdc392799ca33
-
SHA256
7fdd453b11758f107bdda172822c8e418763f8eb8919a7e82f059723f567319a
-
SHA512
7407d52e3f518bad562d702b9fde3af2ea5c8fcd634474ae0b2c2229de7e2748c0520e420542b2497acc20b2ad7f5b04030713210ec82343856436a5d15c994d
-
SSDEEP
384:E3eVES+/xwGkRKJYFdSlM61qmTTMVF9/q5l0:bGS+ZfbJYFMO8qYoAq
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" bebe00983a92f88509708b574af4247b_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe bebe00983a92f88509708b574af4247b_JaffaCakes118.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2316 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2976 ipconfig.exe 2800 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2316 tasklist.exe Token: SeDebugPrivilege 2800 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2676 bebe00983a92f88509708b574af4247b_JaffaCakes118.exe 2676 bebe00983a92f88509708b574af4247b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2836 2676 bebe00983a92f88509708b574af4247b_JaffaCakes118.exe 28 PID 2676 wrote to memory of 2836 2676 bebe00983a92f88509708b574af4247b_JaffaCakes118.exe 28 PID 2676 wrote to memory of 2836 2676 bebe00983a92f88509708b574af4247b_JaffaCakes118.exe 28 PID 2676 wrote to memory of 2836 2676 bebe00983a92f88509708b574af4247b_JaffaCakes118.exe 28 PID 2836 wrote to memory of 2864 2836 cmd.exe 30 PID 2836 wrote to memory of 2864 2836 cmd.exe 30 PID 2836 wrote to memory of 2864 2836 cmd.exe 30 PID 2836 wrote to memory of 2864 2836 cmd.exe 30 PID 2836 wrote to memory of 2976 2836 cmd.exe 31 PID 2836 wrote to memory of 2976 2836 cmd.exe 31 PID 2836 wrote to memory of 2976 2836 cmd.exe 31 PID 2836 wrote to memory of 2976 2836 cmd.exe 31 PID 2836 wrote to memory of 2316 2836 cmd.exe 32 PID 2836 wrote to memory of 2316 2836 cmd.exe 32 PID 2836 wrote to memory of 2316 2836 cmd.exe 32 PID 2836 wrote to memory of 2316 2836 cmd.exe 32 PID 2836 wrote to memory of 2636 2836 cmd.exe 34 PID 2836 wrote to memory of 2636 2836 cmd.exe 34 PID 2836 wrote to memory of 2636 2836 cmd.exe 34 PID 2836 wrote to memory of 2636 2836 cmd.exe 34 PID 2636 wrote to memory of 2612 2636 net.exe 35 PID 2636 wrote to memory of 2612 2636 net.exe 35 PID 2636 wrote to memory of 2612 2636 net.exe 35 PID 2636 wrote to memory of 2612 2636 net.exe 35 PID 2836 wrote to memory of 2800 2836 cmd.exe 36 PID 2836 wrote to memory of 2800 2836 cmd.exe 36 PID 2836 wrote to memory of 2800 2836 cmd.exe 36 PID 2836 wrote to memory of 2800 2836 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\bebe00983a92f88509708b574af4247b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bebe00983a92f88509708b574af4247b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2864
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2976
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2612
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD58729318d9cbf8846c2c5a7b0f7a977f0
SHA15c4358a8261b0655ce9aa2781be9e4af67218915
SHA2562986118e911c211b30d89f5ff105567e882b20513ff728be3731ba5e42f903ea
SHA5129dbbd52a66276f6571db514d20279db2acf0afa4b72d7fbb8ac152496bf8326e4d2baef31ba11ce64124833f6234cca8c0463daef0d3e8e507f2fb296ad0596e