Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 17:47
Static task
static1
Behavioral task
behavioral1
Sample
bebe00983a92f88509708b574af4247b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bebe00983a92f88509708b574af4247b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
bebe00983a92f88509708b574af4247b_JaffaCakes118.exe
-
Size
24KB
-
MD5
bebe00983a92f88509708b574af4247b
-
SHA1
9fc97715319a090107702cdef13bdc392799ca33
-
SHA256
7fdd453b11758f107bdda172822c8e418763f8eb8919a7e82f059723f567319a
-
SHA512
7407d52e3f518bad562d702b9fde3af2ea5c8fcd634474ae0b2c2229de7e2748c0520e420542b2497acc20b2ad7f5b04030713210ec82343856436a5d15c994d
-
SSDEEP
384:E3eVES+/xwGkRKJYFdSlM61qmTTMVF9/q5l0:bGS+ZfbJYFMO8qYoAq
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" bebe00983a92f88509708b574af4247b_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe bebe00983a92f88509708b574af4247b_JaffaCakes118.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2024 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5048 ipconfig.exe 2248 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2024 tasklist.exe Token: SeDebugPrivilege 2248 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4596 bebe00983a92f88509708b574af4247b_JaffaCakes118.exe 4596 bebe00983a92f88509708b574af4247b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4596 wrote to memory of 3632 4596 bebe00983a92f88509708b574af4247b_JaffaCakes118.exe 86 PID 4596 wrote to memory of 3632 4596 bebe00983a92f88509708b574af4247b_JaffaCakes118.exe 86 PID 4596 wrote to memory of 3632 4596 bebe00983a92f88509708b574af4247b_JaffaCakes118.exe 86 PID 3632 wrote to memory of 1860 3632 cmd.exe 89 PID 3632 wrote to memory of 1860 3632 cmd.exe 89 PID 3632 wrote to memory of 1860 3632 cmd.exe 89 PID 3632 wrote to memory of 5048 3632 cmd.exe 90 PID 3632 wrote to memory of 5048 3632 cmd.exe 90 PID 3632 wrote to memory of 5048 3632 cmd.exe 90 PID 3632 wrote to memory of 2024 3632 cmd.exe 91 PID 3632 wrote to memory of 2024 3632 cmd.exe 91 PID 3632 wrote to memory of 2024 3632 cmd.exe 91 PID 3632 wrote to memory of 1040 3632 cmd.exe 94 PID 3632 wrote to memory of 1040 3632 cmd.exe 94 PID 3632 wrote to memory of 1040 3632 cmd.exe 94 PID 1040 wrote to memory of 4392 1040 net.exe 95 PID 1040 wrote to memory of 4392 1040 net.exe 95 PID 1040 wrote to memory of 4392 1040 net.exe 95 PID 3632 wrote to memory of 2248 3632 cmd.exe 96 PID 3632 wrote to memory of 2248 3632 cmd.exe 96 PID 3632 wrote to memory of 2248 3632 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\bebe00983a92f88509708b574af4247b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bebe00983a92f88509708b574af4247b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:1860
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5048
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:4392
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5dddaf0dd1082b6b981b95c4ad96d683a
SHA1c2652b3038a9bef6f43453450b8240b901e2bab1
SHA256c4a921116a3696a04c9e447a5310f5bca2a4f1bfaf98094f06559f14d23ffc76
SHA512338ffc60dd3a3679fb4cfc5f72cd8f8ec11af5238e2deb100cbbb810dd7a6218f04d4b9aad26c9c437a6c094e138c47107cd3d4246fa17b4c0565aa39f991f41