Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/04/2024, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe
-
Size
238KB
-
MD5
bed11572709b62b4bc8dd0d4943fc268
-
SHA1
e5fc3f96cafc40cbac8fd571bfc290ce138b228b
-
SHA256
9163b1fe03e1f9aa708fa70c171f777e0baee6146022273cdf957a750af912d5
-
SHA512
6f9f7ab61f2575cf5248329b4aed40dd665c3e38a8283bd3e5e90e34e9aff904751629e94f77bf388ef39e54f10fa11c110714922cc620e699ec880fe2cf7055
-
SSDEEP
3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/e8ikgnYHfQlAv:o68i3odBiTl2+TCU/Qk8KfQlEeY
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart" bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\winhash_up.exez bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe File created C:\Windows\SHARE_TEMP\Icon5.ico bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe File created C:\Windows\SHARE_TEMP\Icon7.ico bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe File created C:\Windows\SHARE_TEMP\Icon12.ico bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe File created C:\Windows\SHARE_TEMP\Icon3.ico bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe File created C:\Windows\SHARE_TEMP\Icon14.ico bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe File created C:\Windows\winhash_up.exe bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe File created C:\Windows\SHARE_TEMP\Icon2.ico bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe File created C:\Windows\SHARE_TEMP\Icon6.ico bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe File created C:\Windows\SHARE_TEMP\Icon10.ico bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe File created C:\Windows\SHARE_TEMP\Icon13.ico bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe File created C:\Windows\winhash_up.exez bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe File created C:\Windows\bugMAKER.bat bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2572 1732 bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe 28 PID 1732 wrote to memory of 2572 1732 bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe 28 PID 1732 wrote to memory of 2572 1732 bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe 28 PID 1732 wrote to memory of 2572 1732 bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bed11572709b62b4bc8dd0d4943fc268_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\bugMAKER.bat2⤵PID:2572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90B
MD5631bfd7ffbdb3f7102b41210f17fe5bf
SHA137c5a8b263e1f39da8777e9979a6ec2f22dcad59
SHA2560d1a537e5d1f105e42bfe3615770a5c916708a77b71fff74508753221b212d50
SHA5122635a065c73880c7cfec7c24094a99e32ff98ea015f9957e8164e548fe2c4d20ebc1e06511f207a37a946b8c9ce6b4527e2c6de4016cf319f9e21de197a7eca1