Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 02:59
Static task
static1
Behavioral task
behavioral1
Sample
f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exe
-
Size
203KB
-
MD5
a2dfd2f2415ea68079e23e7556b7dc0e
-
SHA1
43a08afc2797f44720d05190960ca7425426f334
-
SHA256
f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0
-
SHA512
0e72f5e46b67b1723dda9931307a5cf919e3ea5d3a4bda1b3f5528f9c95027ccebe076dc7e58b628646fe2a68d0088b3d62d3d68aa4cf0ae7c80ff9572e349a2
-
SSDEEP
3072:iwKO2LMVS5fgevom6PJiMrt+NqaDGngsYrBp8OBwpssGnJyYK+p16jxZRU9SD:63LMfGMTxFYP8xpsrJyY0C9S
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://gxutc2c.com/tmp/index.php
http://proekt8.ru/tmp/index.php
http://mth.com.ua/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1212 -
Executes dropped EXE 1 IoCs
Processes:
gfravrwpid process 2616 gfravrw -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exegfravrwdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gfravrw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gfravrw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gfravrw -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exepid process 2228 f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exe 2228 f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exe 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exegfravrwpid process 2228 f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exe 2616 gfravrw -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 1212 Token: SeShutdownPrivilege 1212 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1212 1212 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1212 1212 -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 956 wrote to memory of 2616 956 taskeng.exe gfravrw PID 956 wrote to memory of 2616 956 taskeng.exe gfravrw PID 956 wrote to memory of 2616 956 taskeng.exe gfravrw PID 956 wrote to memory of 2616 956 taskeng.exe gfravrw -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {3DABA6DE-CCA5-409B-B166-248EF5BCFB21} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\gfravrwC:\Users\Admin\AppData\Roaming\gfravrw2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a806327e2619e5bce094ca434584aa5d
SHA1f87da9869820834a74cf2ec916eacad30844df65
SHA25629315227c5ebe88746cec8e8736c1b0ad6a90250f24fe4026efcde5a83ce9bdb
SHA5124b5d73d4d66919b34aefaddd982f18b0e52fb406964b0ae53605971408b9831f51869c91b31361decd4e4a8200237b4fc5e2095299e7a1bb0b494ae86fc48e9e
-
C:\Users\Admin\AppData\Local\Temp\CabC229.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\TarC3C5.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Roaming\gfravrwFilesize
203KB
MD5a2dfd2f2415ea68079e23e7556b7dc0e
SHA143a08afc2797f44720d05190960ca7425426f334
SHA256f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0
SHA5120e72f5e46b67b1723dda9931307a5cf919e3ea5d3a4bda1b3f5528f9c95027ccebe076dc7e58b628646fe2a68d0088b3d62d3d68aa4cf0ae7c80ff9572e349a2
-
memory/1212-4-0x0000000001C60000-0x0000000001C76000-memory.dmpFilesize
88KB
-
memory/1212-82-0x0000000002E60000-0x0000000002E76000-memory.dmpFilesize
88KB
-
memory/2228-5-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2228-1-0x0000000000580000-0x0000000000680000-memory.dmpFilesize
1024KB
-
memory/2228-3-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2228-2-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/2616-80-0x0000000000590000-0x0000000000690000-memory.dmpFilesize
1024KB
-
memory/2616-81-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2616-83-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB