Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16/04/2024, 13:37
Behavioral task
behavioral1
Sample
f39b619985c34fe9955eab453271b841_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
-
Target
f39b619985c34fe9955eab453271b841_JaffaCakes118.exe
-
Size
960KB
-
MD5
f39b619985c34fe9955eab453271b841
-
SHA1
b55233315b4c82f5cca7b41280c050ef98702709
-
SHA256
da32bbb29aaadd8dd207d1b6c226d0157849874a3abd9369a1ec21ac9aae6443
-
SHA512
3ad25f2c2dacab2fe848bd111be71366ffea608f4e901836af11093985a428dc739f758db1c87726fda4f6a49c6cad9ac73c32e2b6429724fe5268f375368e28
-
SSDEEP
12288:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aaE6KwyF5L0Y2D1PqLx6Wq4aaE6KwyF5L0Y/:1thEVaPqLBthEVaPqLHthEVaPqLTthZ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 3292 svhost.exe -
resource yara_rule behavioral2/memory/1768-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x0008000000023403-3.dat upx behavioral2/memory/3292-5-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x0007000000023408-123.dat upx behavioral2/memory/1768-611-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/3292-2573-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1768-611-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral2/memory/3292-2573-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe f39b619985c34fe9955eab453271b841_JaffaCakes118.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3292 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe 3292 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1768 wrote to memory of 3292 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 85 PID 1768 wrote to memory of 3292 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 85 PID 1768 wrote to memory of 3292 1768 f39b619985c34fe9955eab453271b841_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\f39b619985c34fe9955eab453271b841_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f39b619985c34fe9955eab453271b841_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD50525a5a10acc7bac9fd6ba186494b61a
SHA137ad20abf59ea0be30470232c62a8d816cc8d548
SHA25657dc44fff47a9f0ca22c22787842a9ad7205755b43a4704bf8aa0332f4e90559
SHA5127d80fabcf63c9e85b33f60484171a7aa47a321006921739542129ed923e6540af6b650cfb34b3509db8eeac6a5c8a10b310ce8f4c028f2c17a3150c3f2e869b4
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
960KB
MD55ddf53244312c2b91c9ffaa38a6d77f1
SHA194dd11a61bb05ee904e57e8ec4c38d47400d3e09
SHA25698c284a0d8a72296d00d4e20e057ff7cc0f33a94d6f5ffd4257eb3bc07310db3
SHA512b5dfd92291d55b63468850dc3c3080cb7cbc01e98d654c8660148e365290b5228419fb4f997cf1133eabd1571744843a6c9e85965c5a18518615b76c6f1c1557