Analysis
-
max time kernel
2s -
max time network
15s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 01:43
Behavioral task
behavioral1
Sample
f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe
Resource
win7-20240220-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe
Resource
win10v2004-20240412-en
6 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe
-
Size
296KB
-
MD5
f001b910bdfec9b9546830efe1ce8710
-
SHA1
c7aa465a546f9df2ac5537c0d922410262d854d7
-
SHA256
7239e7c701944b48f9d6fb8a29dbee0e941dcbe07f9bcb1bf50cb97269a62525
-
SHA512
d97ff78e26ba3e8989b83b19a648555cdad0fd9f19d31ef0375c77aa6129690b91c219fdd3e42315b2264f72c58f7bf0d41ba89754b15ba9c83f4910faa1d7b7
-
SSDEEP
6144:POpslFlqEhdBCkWYxuukP1pjSKSNVkq/MVJb9:PwslvTBd47GLRMTb9
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe" f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe" f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6UD61T00-Q26U-7025-0OM6-T148V4WUPRRG} f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6UD61T00-Q26U-7025-0OM6-T148V4WUPRRG}\StubPath = "c:\\directory\\CyberGate\\install\\server.exe Restart" f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/3076-3-0x0000000010410000-0x0000000010475000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "c:\\directory\\CyberGate\\install\\server.exe" f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "c:\\directory\\CyberGate\\install\\server.exe" f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exepid process 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exedescription pid process target process PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe PID 3076 wrote to memory of 1268 3076 f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f001b910bdfec9b9546830efe1ce8710_JaffaCakes118.exe"2⤵