Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-04-2024 05:06
Behavioral task
behavioral1
Sample
cba5cb767bab243da124616f665b53cc_JaffaCakes118.exe
Resource
win7-20240221-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
cba5cb767bab243da124616f665b53cc_JaffaCakes118.exe
Resource
win10v2004-20240226-en
9 signatures
150 seconds
General
-
Target
cba5cb767bab243da124616f665b53cc_JaffaCakes118.exe
-
Size
34KB
-
MD5
cba5cb767bab243da124616f665b53cc
-
SHA1
3e1157e71c5fb61bd7027c7c69a1fd420bc15330
-
SHA256
0aad8e3326bb0685465cd130f41ad0774c040aa55333bfd8076fb0e194e710a9
-
SHA512
03440b5531c6b3926df1521477a2149aba08ab535fd3bc0a3c847d8646f82e9fd99a49f1f861571c8175c15e2c70e1e2f2c8ea957e77171a4ff1935f31932beb
-
SSDEEP
768:0p22qWFcy5XQ7lO41uirwA98p3MpkNBxd0cJWV6dy/x9J2:0pYoX58z1uirL98xMWnT0OQ9J2
Score
10/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2112-0-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\131DE66E = "C:\\Users\\Admin\\AppData\\Roaming\\131DE66E\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid process 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe 1944 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 1944 winver.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cba5cb767bab243da124616f665b53cc_JaffaCakes118.exewinver.exedescription pid process target process PID 2112 wrote to memory of 1944 2112 cba5cb767bab243da124616f665b53cc_JaffaCakes118.exe winver.exe PID 2112 wrote to memory of 1944 2112 cba5cb767bab243da124616f665b53cc_JaffaCakes118.exe winver.exe PID 2112 wrote to memory of 1944 2112 cba5cb767bab243da124616f665b53cc_JaffaCakes118.exe winver.exe PID 2112 wrote to memory of 1944 2112 cba5cb767bab243da124616f665b53cc_JaffaCakes118.exe winver.exe PID 2112 wrote to memory of 1944 2112 cba5cb767bab243da124616f665b53cc_JaffaCakes118.exe winver.exe PID 1944 wrote to memory of 1196 1944 winver.exe Explorer.EXE PID 1944 wrote to memory of 1104 1944 winver.exe taskhost.exe PID 1944 wrote to memory of 1152 1944 winver.exe Dwm.exe PID 1944 wrote to memory of 1196 1944 winver.exe Explorer.EXE
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1152
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\cba5cb767bab243da124616f665b53cc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cba5cb767bab243da124616f665b53cc_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1944