Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-04-2024 08:30
Static task
static1
Behavioral task
behavioral1
Sample
ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exe
-
Size
212KB
-
MD5
860d926352801d6a36bc26c027ca6dcb
-
SHA1
0b71dcb0f98250ade72691b8503d01f7e33e468b
-
SHA256
ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d
-
SHA512
2b3a743f9b17ba3689d57bdc995e8f63e5fba2845251958b3835410a9f910552552aa3dbba19fcb16eaac5f9c9738e03f5238597d701319804a7bc4710e3d057
-
SSDEEP
3072:FfULIw/0KK/A8vohmH6saXQHpimE/sjiINkZI1qqwU:FfULnaXohmHUXmpixDl
Malware Config
Extracted
smokeloader
pub2
Extracted
smokeloader
2022
http://gxutc2c.com/tmp/index.php
http://proekt8.ru/tmp/index.php
http://mth.com.ua/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3552 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exepid process 3864 ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exe 3864 ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exe 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 3552 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exepid process 3864 ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ecfe89307878026257826ff9a3f994d0219099355bc019de45b85cda770d925d_JaffaCakes118.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3552-5-0x00000000029D0000-0x00000000029E6000-memory.dmpFilesize
88KB
-
memory/3864-1-0x00000000008E0000-0x00000000009E0000-memory.dmpFilesize
1024KB
-
memory/3864-2-0x00000000009E0000-0x00000000009EB000-memory.dmpFilesize
44KB
-
memory/3864-3-0x0000000000400000-0x0000000000857000-memory.dmpFilesize
4.3MB
-
memory/3864-4-0x0000000000400000-0x0000000000857000-memory.dmpFilesize
4.3MB
-
memory/3864-6-0x0000000000400000-0x0000000000857000-memory.dmpFilesize
4.3MB