Analysis
-
max time kernel
159s -
max time network
176s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-04-2024 18:45
Static task
static1
Behavioral task
behavioral1
Sample
bff05a73e8b0a0babef02d20f5522e44_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bff05a73e8b0a0babef02d20f5522e44_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
bff05a73e8b0a0babef02d20f5522e44_JaffaCakes118.exe
-
Size
148KB
-
MD5
bff05a73e8b0a0babef02d20f5522e44
-
SHA1
f62a1f7932b793af72d81151d6d54c0dc848ea1a
-
SHA256
2a236661e0e18e2e9c7faa3d32d3dcee3b61933f95a50fb6539313edaf40534d
-
SHA512
1855a88dc5079f7e4802f957ab2a47e329221185d2bad1abd5bfec2d9320fe9588f88b930f9ecf645cf4925407874002eeb74fd453ef423c0e7096e6729c23e9
-
SSDEEP
1536:cv+pJdyvHh9Yvu356AlGC/kpNfDnfn8bbxvVOu3MwJMaKtqj78gE8v27O:j/dwh9uu39N81SbxthE8vCO
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\ED49E64E = "C:\\Users\\Admin\\AppData\\Roaming\\ED49E64E\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid process 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe 2508 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2508 winver.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
bff05a73e8b0a0babef02d20f5522e44_JaffaCakes118.exepid process 1068 bff05a73e8b0a0babef02d20f5522e44_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
bff05a73e8b0a0babef02d20f5522e44_JaffaCakes118.exewinver.exedescription pid process target process PID 1068 wrote to memory of 2508 1068 bff05a73e8b0a0babef02d20f5522e44_JaffaCakes118.exe winver.exe PID 1068 wrote to memory of 2508 1068 bff05a73e8b0a0babef02d20f5522e44_JaffaCakes118.exe winver.exe PID 1068 wrote to memory of 2508 1068 bff05a73e8b0a0babef02d20f5522e44_JaffaCakes118.exe winver.exe PID 1068 wrote to memory of 2508 1068 bff05a73e8b0a0babef02d20f5522e44_JaffaCakes118.exe winver.exe PID 1068 wrote to memory of 2508 1068 bff05a73e8b0a0babef02d20f5522e44_JaffaCakes118.exe winver.exe PID 2508 wrote to memory of 1260 2508 winver.exe Explorer.EXE PID 2508 wrote to memory of 1124 2508 winver.exe taskhost.exe PID 2508 wrote to memory of 1164 2508 winver.exe Dwm.exe PID 2508 wrote to memory of 1260 2508 winver.exe Explorer.EXE
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\bff05a73e8b0a0babef02d20f5522e44_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bff05a73e8b0a0babef02d20f5522e44_JaffaCakes118.exe"2⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2508