Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe
-
Size
232KB
-
MD5
f3dd298718e9cb80718273b2013a5002
-
SHA1
3cfdcad96c8f0aacb8afbc257f5ab6ae75b42511
-
SHA256
be26607002e534fd393f7037e54566f041c0fa08f2d2bd8d5c0668a739d10bd7
-
SHA512
1b3e011ed027972096217c5777a76f6a9395a4fddc72c748e3f0d134f356e783c0505435f1ba76f827944bcf45fd58b60aa3bb1231676a316407b1bdad6b1176
-
SSDEEP
6144:iZue0vvLUp4fqHUa5OugJykJbyP2X3nV8GNLF:iZdQL9Y5zeyanv9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2560 birth00.bin.exe 2520 birth00.bin.exe 2692 MOk63C2.exe -
Loads dropped DLL 5 IoCs
pid Process 1716 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 1716 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 2560 birth00.bin.exe 2520 birth00.bin.exe 2520 birth00.bin.exe -
resource yara_rule behavioral1/memory/1716-4-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/1716-5-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/1716-8-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/1716-11-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/1716-10-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/1716-12-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/1716-13-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/1716-14-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/1716-15-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/1716-16-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/2520-47-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/2520-52-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/2520-53-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/2520-56-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral1/memory/1716-153-0x0000000000400000-0x000000000046D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\XA7DZZWA9UUU6WVIAMCMRBBSFG = "C:\\birth00.bin\\birth00.bin.exe" MOk63C2.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2172 set thread context of 1716 2172 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 28 PID 2560 set thread context of 2520 2560 birth00.bin.exe 30 -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PhishingFilter MOk63C2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" MOk63C2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0" MOk63C2.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery MOk63C2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0" MOk63C2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1716 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 1716 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 2520 birth00.bin.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe 2692 MOk63C2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1716 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe Token: SeDebugPrivilege 1716 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe Token: SeDebugPrivilege 1716 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe Token: SeDebugPrivilege 1716 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe Token: SeDebugPrivilege 2520 birth00.bin.exe Token: SeDebugPrivilege 2520 birth00.bin.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe Token: SeDebugPrivilege 2692 MOk63C2.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2172 wrote to memory of 1716 2172 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 28 PID 2172 wrote to memory of 1716 2172 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 28 PID 2172 wrote to memory of 1716 2172 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 28 PID 2172 wrote to memory of 1716 2172 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 28 PID 2172 wrote to memory of 1716 2172 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 28 PID 2172 wrote to memory of 1716 2172 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 28 PID 2172 wrote to memory of 1716 2172 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 28 PID 2172 wrote to memory of 1716 2172 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 28 PID 1716 wrote to memory of 2560 1716 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 29 PID 1716 wrote to memory of 2560 1716 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 29 PID 1716 wrote to memory of 2560 1716 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 29 PID 1716 wrote to memory of 2560 1716 f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe 29 PID 2560 wrote to memory of 2520 2560 birth00.bin.exe 30 PID 2560 wrote to memory of 2520 2560 birth00.bin.exe 30 PID 2560 wrote to memory of 2520 2560 birth00.bin.exe 30 PID 2560 wrote to memory of 2520 2560 birth00.bin.exe 30 PID 2560 wrote to memory of 2520 2560 birth00.bin.exe 30 PID 2560 wrote to memory of 2520 2560 birth00.bin.exe 30 PID 2560 wrote to memory of 2520 2560 birth00.bin.exe 30 PID 2560 wrote to memory of 2520 2560 birth00.bin.exe 30 PID 2520 wrote to memory of 2692 2520 birth00.bin.exe 31 PID 2520 wrote to memory of 2692 2520 birth00.bin.exe 31 PID 2520 wrote to memory of 2692 2520 birth00.bin.exe 31 PID 2520 wrote to memory of 2692 2520 birth00.bin.exe 31 PID 2520 wrote to memory of 2692 2520 birth00.bin.exe 31 PID 2520 wrote to memory of 2692 2520 birth00.bin.exe 31 PID 2692 wrote to memory of 1716 2692 MOk63C2.exe 28 PID 2692 wrote to memory of 1716 2692 MOk63C2.exe 28 PID 2692 wrote to memory of 1716 2692 MOk63C2.exe 28 PID 2692 wrote to memory of 1716 2692 MOk63C2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3dd298718e9cb80718273b2013a5002_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\birth00.bin\birth00.bin.exe"C:\birth00.bin\birth00.bin.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\birth00.bin\birth00.bin.exe"C:\birth00.bin\birth00.bin.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\MOk63C2.exe"C:\Users\Admin\AppData\Local\Temp\MOk63C2.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD5f3dd298718e9cb80718273b2013a5002
SHA13cfdcad96c8f0aacb8afbc257f5ab6ae75b42511
SHA256be26607002e534fd393f7037e54566f041c0fa08f2d2bd8d5c0668a739d10bd7
SHA5121b3e011ed027972096217c5777a76f6a9395a4fddc72c748e3f0d134f356e783c0505435f1ba76f827944bcf45fd58b60aa3bb1231676a316407b1bdad6b1176
-
Filesize
54KB
MD5f649ccdf326dc92ce1c5a38013e4da0c
SHA1e89dfa4ca712613d2273738c570e8e4ff1cd58d7
SHA2568634ecabfc6210ce49f42bea848974011dd967d24bc9f1fc087413060bd09af7
SHA512b1f8d27bfefa2208c22c035461a7cd5b8625e173f969a3662427ef89da5413ad0705e9ef14a746cbadac2965592d8080944a8177ecc09f5448fe80657a1a1154
-
Filesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be