Resubmissions
20-04-2024 15:40
240420-s4bz3sbg96 10Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 15:40
Static task
static1
Behavioral task
behavioral1
Sample
fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe
-
Size
575KB
-
MD5
fd1915351b866de1d53e9460d2d0b5cd
-
SHA1
1eb9cf61e9a7799ac3635c3040899a043c08e0c1
-
SHA256
b3040213159633a30e364d15cead228ab5ae84c1c8322d8a323bc77170a20acd
-
SHA512
0947cbbadcb7b2fbab3dad67ca900246a74e38b7db4bc5f3f440fa694e2a2102daac25aad362f97d11c3d7ecc78d6890da918e1f5533b2db78bc70e404581c1c
-
SSDEEP
12288:R84PU9vPU9Cv2pzsg/XgOsBgo0q4wM1Yj5C6C9IfyFBzY3:R8uXgOsBgo0q4wMJxFB03
Malware Config
Extracted
asyncrat
0.5.7B
Default
podzeye.duckdns.org:4422
podzeye.duckdns.org:4442
podzeye.duckdns.org:4433
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/2872-3-0x0000000000770000-0x0000000000782000-memory.dmp CustAttr -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exedescription pid process target process PID 2872 set thread context of 2440 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exepid process 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exefd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe Token: SeDebugPrivilege 2440 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exedescription pid process target process PID 2872 wrote to memory of 2584 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe schtasks.exe PID 2872 wrote to memory of 2584 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe schtasks.exe PID 2872 wrote to memory of 2584 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe schtasks.exe PID 2872 wrote to memory of 2584 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe schtasks.exe PID 2872 wrote to memory of 2424 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2424 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2424 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2424 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2432 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2432 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2432 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2432 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2440 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2440 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2440 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2440 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2440 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2440 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2440 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2440 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe PID 2872 wrote to memory of 2440 2872 fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eYhwPQL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD5D5.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd1915351b866de1d53e9460d2d0b5cd_JaffaCakes118.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD5D5.tmpFilesize
1KB
MD5abd6a0730fbc7fca248ab2866910f6d1
SHA1a3687cca2f985cbdcae73b373ee273cf61f6dd79
SHA256f572988c6aea2259c38de6289a4f4f53da837ea4475506a5ea9da16bbf3754ea
SHA51205bfd30e962aed8da51ba66a65362d5bb11f5fc201042931b7a7e1b83fbb7d446e76c0e3b524d3a0902012d09f276d9f3e75b66f20d0f59160bec081f1627503
-
memory/2440-21-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2440-19-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2440-14-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2440-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2440-16-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2440-28-0x0000000004F40000-0x0000000004F80000-memory.dmpFilesize
256KB
-
memory/2440-27-0x0000000074AD0000-0x00000000751BE000-memory.dmpFilesize
6.9MB
-
memory/2440-26-0x0000000004F40000-0x0000000004F80000-memory.dmpFilesize
256KB
-
memory/2440-13-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2440-15-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2440-25-0x0000000074AD0000-0x00000000751BE000-memory.dmpFilesize
6.9MB
-
memory/2440-23-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2872-7-0x0000000002020000-0x0000000002036000-memory.dmpFilesize
88KB
-
memory/2872-4-0x0000000074AD0000-0x00000000751BE000-memory.dmpFilesize
6.9MB
-
memory/2872-0-0x0000000000830000-0x00000000008C6000-memory.dmpFilesize
600KB
-
memory/2872-5-0x00000000003E0000-0x0000000000420000-memory.dmpFilesize
256KB
-
memory/2872-3-0x0000000000770000-0x0000000000782000-memory.dmpFilesize
72KB
-
memory/2872-24-0x0000000074AD0000-0x00000000751BE000-memory.dmpFilesize
6.9MB
-
memory/2872-1-0x0000000074AD0000-0x00000000751BE000-memory.dmpFilesize
6.9MB
-
memory/2872-2-0x00000000003E0000-0x0000000000420000-memory.dmpFilesize
256KB
-
memory/2872-6-0x0000000002090000-0x00000000020F0000-memory.dmpFilesize
384KB