Analysis
-
max time kernel
143s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 22:15
Static task
static1
Behavioral task
behavioral1
Sample
fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe
-
Size
8.9MB
-
MD5
fb48807b8d01f1ba353018b2d4a38c8d
-
SHA1
ed2f17a502b147384d080b9d5faed3bc27eb289b
-
SHA256
4fd62a2e42e0ad9827f0b5703607c0de1ab31e3dabd60aaf3cb56dbba746df04
-
SHA512
838c0f0cb61ee3d3a93f5c5cab5546b62802243d2c39c61205c85325bdac40ca1f0752c54f89c7362d8920e2e1faad21596688b1b45bc78a808ed53e85fa8654
-
SSDEEP
196608:8yazg7DSmyazg7DSmRyazg7DSmyazg7DSmQ:wg7uqg7u8g7uqg7uj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2572 7D57AD13E21.exe 2836 Scegli_nome_allegato.exe 2704 7D57AD13E21.exe -
Loads dropped DLL 3 IoCs
pid Process 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\7D57AD13E21.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2572 set thread context of 2704 2572 7D57AD13E21.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main Scegli_nome_allegato.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Scegli_nome_allegato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Scegli_nome_allegato.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2992 reg.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2836 Scegli_nome_allegato.exe 2836 Scegli_nome_allegato.exe 2836 Scegli_nome_allegato.exe 2704 7D57AD13E21.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2992 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 28 PID 2060 wrote to memory of 2992 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 28 PID 2060 wrote to memory of 2992 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 28 PID 2060 wrote to memory of 2992 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 28 PID 2060 wrote to memory of 2572 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2572 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2572 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2572 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2836 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 31 PID 2060 wrote to memory of 2836 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 31 PID 2060 wrote to memory of 2836 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 31 PID 2060 wrote to memory of 2836 2060 fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe 31 PID 2572 wrote to memory of 2704 2572 7D57AD13E21.exe 33 PID 2572 wrote to memory of 2704 2572 7D57AD13E21.exe 33 PID 2572 wrote to memory of 2704 2572 7D57AD13E21.exe 33 PID 2572 wrote to memory of 2704 2572 7D57AD13E21.exe 33 PID 2572 wrote to memory of 2704 2572 7D57AD13E21.exe 33 PID 2572 wrote to memory of 2704 2572 7D57AD13E21.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe" /f2⤵
- Adds Run key to start application
- Modifies registry key
PID:2992
-
-
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2704
-
-
-
C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.9MB
MD5a4800872b42a603cbc843ccfee4a7a7c
SHA1915c68404dd7cf502e1307d6f27e547ba8a5bc6a
SHA25634ee21662a0d4689cc1861969931924ad64dcfa56a73d3a6a4e90bd3230fd086
SHA51215ac79d23747104ff69e291a660d0ffa29aec6ef11fd9f2a5ed42c1025f2a0f5cebfd0addfd5eae33e5a3e51b67f3a06b441f08a748b9576d8f3ac9b5c718b27
-
Filesize
1.0MB
MD5a2f259ceb892d3b0d1d121997c8927e3
SHA16e0a7239822b8d365d690a314f231286355f6cc6
SHA256ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
SHA5125ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad