Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 20:51
Behavioral task
behavioral1
Sample
f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe
-
Size
160KB
-
MD5
f1e64d25c6a87b83b62fe6513100b24c
-
SHA1
b908f972ea5a81e9976b65c14b134c700cb1f4fb
-
SHA256
685dab2ff06839a9585ce8b0aede037364a4ac1c284d4aa1bbc3b462d69343cc
-
SHA512
8915978e9b09326cbe2a3145cc9662c06c360c5f46714e46c47784009a0c8488ac8104880fc8353929a3c39412c4a434e560ef308075e119f19b74870470bd06
-
SSDEEP
1536:yEY+mFM2HXKZgi0Iksu+XM5/HtAQ9J6xph:5Y+4MiIkLZJNAQ9J6v
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1920-0-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\31B573F8 = "C:\\Users\\Admin\\AppData\\Roaming\\31B573F8\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid process 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe 2900 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2900 winver.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exewinver.exedescription pid process target process PID 1920 wrote to memory of 2900 1920 f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe winver.exe PID 1920 wrote to memory of 2900 1920 f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe winver.exe PID 1920 wrote to memory of 2900 1920 f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe winver.exe PID 1920 wrote to memory of 2900 1920 f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe winver.exe PID 1920 wrote to memory of 2900 1920 f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe winver.exe PID 2900 wrote to memory of 1088 2900 winver.exe Explorer.EXE PID 2900 wrote to memory of 1060 2900 winver.exe Dwm.exe PID 2900 wrote to memory of 1088 2900 winver.exe Explorer.EXE PID 2900 wrote to memory of 1128 2900 winver.exe taskhost.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1060-24-0x00000000775F1000-0x00000000775F2000-memory.dmpFilesize
4KB
-
memory/1060-23-0x0000000001EA0000-0x0000000001EA6000-memory.dmpFilesize
24KB
-
memory/1088-20-0x0000000002550000-0x0000000002556000-memory.dmpFilesize
24KB
-
memory/1088-11-0x00000000775F1000-0x00000000775F2000-memory.dmpFilesize
4KB
-
memory/1088-2-0x0000000003040000-0x0000000003046000-memory.dmpFilesize
24KB
-
memory/1088-25-0x0000000002550000-0x0000000002556000-memory.dmpFilesize
24KB
-
memory/1088-9-0x0000000003040000-0x0000000003046000-memory.dmpFilesize
24KB
-
memory/1128-26-0x00000000003D0000-0x00000000003D6000-memory.dmpFilesize
24KB
-
memory/1128-22-0x00000000003D0000-0x00000000003D6000-memory.dmpFilesize
24KB
-
memory/1920-3-0x0000000001D90000-0x0000000002790000-memory.dmpFilesize
10.0MB
-
memory/1920-0-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1920-12-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1920-13-0x0000000001D90000-0x0000000002790000-memory.dmpFilesize
10.0MB
-
memory/1920-1-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/2900-15-0x0000000000120000-0x0000000000126000-memory.dmpFilesize
24KB
-
memory/2900-16-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/2900-4-0x0000000000120000-0x0000000000126000-memory.dmpFilesize
24KB
-
memory/2900-6-0x000000007779F000-0x00000000777A0000-memory.dmpFilesize
4KB
-
memory/2900-7-0x000000007779F000-0x00000000777A1000-memory.dmpFilesize
8KB
-
memory/2900-10-0x0000000000CA0000-0x0000000000CB6000-memory.dmpFilesize
88KB
-
memory/2900-8-0x00000000777A0000-0x00000000777A1000-memory.dmpFilesize
4KB
-
memory/2900-30-0x0000000000120000-0x0000000000126000-memory.dmpFilesize
24KB
-
memory/2900-31-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB