Analysis
- max time kernel
142s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
15/04/2024, 10:11
Behavioral task
behavioral1
Sample
f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
- Target f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe
- Size 566KB
- Sample240415-l8a51sec6x
- SHA256 7a6622649ae3ec1c2b84091ee63256c3f563f70846ea510f77d9420168bafa6d
- MD5 f0cf78ead16c6b7577d705770a0b6ffa
- SHA1 5c56e35eb8d693ac40d8431a2d7c6c181eb49fd7
- SHA512 191d3103cae60267df57895535d12d093150c080b5e7a8ab9701739d413138bdf9502728dc2c45ab6f9a46658df924266d6520dbddc1c596a78caf89ac7b47be
- SSDEEP 12288:ccD66+Z2zkPaCxq41Seng7pXzXhJWhU/p8WxnGW:cjZOklJS4gNDX6hOpvnn
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe - Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{881M3WT3-42W8-B6XO-0O7F-617GUNR78S51} f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{881M3WT3-42W8-B6XO-0O7F-617GUNR78S51}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\install\server.exe f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\install\server.exe f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21 PID 2296 wrote to memory of 1212 2296 f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:976
-
-