Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 15:50
Static task
static1
Behavioral task
behavioral1
Sample
fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
-
Size
3.4MB
-
MD5
fd1cef5cc1c58376c44c193b72163ec4
-
SHA1
a0d0a16dc003b101667e643a9958a8d71e71ac18
-
SHA256
4ab16b326be00b6647ab0253f498dc286d6881b993cb5f95284c2db101b92c75
-
SHA512
c5092a433e1681172757cfc387efa22bb9a54be6da1bd75deeb47ace0d147c020aa98d6400b6bf7ad5a99638a7f9638787b5b262ee31423a3d2a58c9559e958c
-
SSDEEP
24576:wqoti2coq8PhxEY/Syhf9wv8eWrkDVJpL3ynmsSCLlBwSSMJ13t7uWVOT44Iw4Ml:Ct7PBn9Nl2SSZWQ4Mk5+3KTUhn
Malware Config
Signatures
-
ParallaxRat payload 19 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
Processes:
resource yara_rule behavioral1/memory/2556-4-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-9-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-10-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-11-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-12-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-13-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-14-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-15-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-16-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-17-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-18-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-19-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-21-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-20-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-22-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-23-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-24-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-25-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2556-36-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Drops startup file 1 IoCs
Processes:
DllHost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CricketHelp.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exepid process 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exepid process 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exedescription pid process target process PID 2020 wrote to memory of 2556 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe PID 2020 wrote to memory of 2556 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe PID 2020 wrote to memory of 2556 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe PID 2020 wrote to memory of 2556 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe PID 2020 wrote to memory of 2556 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe PID 2020 wrote to memory of 2556 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe PID 2020 wrote to memory of 2556 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe PID 2020 wrote to memory of 2556 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe PID 2020 wrote to memory of 2556 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe PID 2020 wrote to memory of 2556 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe PID 2020 wrote to memory of 2556 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe PID 2020 wrote to memory of 2556 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe PID 2020 wrote to memory of 2556 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe PID 2020 wrote to memory of 1176 2020 fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe"3⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1176-28-0x0000000002E10000-0x0000000002E11000-memory.dmpFilesize
4KB
-
memory/1176-26-0x0000000002E10000-0x0000000002E11000-memory.dmpFilesize
4KB
-
memory/2020-0-0x0000000000270000-0x00000000002EB000-memory.dmpFilesize
492KB
-
memory/2020-1-0x000000007705F000-0x0000000077060000-memory.dmpFilesize
4KB
-
memory/2020-5-0x0000000001FC0000-0x0000000002140000-memory.dmpFilesize
1.5MB
-
memory/2020-33-0x00000000032C0000-0x00000000032C1000-memory.dmpFilesize
4KB
-
memory/2020-31-0x00000000032A0000-0x00000000032A1000-memory.dmpFilesize
4KB
-
memory/2020-32-0x0000000000270000-0x00000000002EB000-memory.dmpFilesize
492KB
-
memory/2020-29-0x0000000000400000-0x0000000000776000-memory.dmpFilesize
3.5MB
-
memory/2020-30-0x00000000032B0000-0x00000000032B1000-memory.dmpFilesize
4KB
-
memory/2556-17-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-24-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-15-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-16-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-13-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-18-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-19-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-21-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-20-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-22-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-23-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-14-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-25-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-12-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-11-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-10-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-9-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-8-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2556-6-0x000000007705F000-0x0000000077060000-memory.dmpFilesize
4KB
-
memory/2556-4-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2556-36-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB