Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 02:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
General
-
Target
022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe
-
Size
204KB
-
MD5
022ef8c1dffca4f9ead73c61a265098f
-
SHA1
7a69d40e89da599562d3164eeb5818a6aa235062
-
SHA256
816f990ed599ecc42d99b35e8aa05bba467dddeaa40fd7e68decc330d8224211
-
SHA512
5a6255e15cfc9211d9f9e30d79aba59a63b3d96f3f8e5c6e282152fa2231d7d254c960fa2dbecbda9bbec65b3bd2b702e558aa0b2a76825f7046d734e94c8274
-
SSDEEP
3072:MexEryQ5wXtfVYPS0FLx/q4z+5JvpgP9A+7q0G56gL86jltjWZvVqs:FxPYFL5q4ggP96a6jzjqvU
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mgmtagent.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1824 set thread context of 940 1824 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 28 PID 2028 set thread context of 3000 2028 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 30 PID 2700 set thread context of 2760 2700 mgmtagent.exe 32 PID 2740 set thread context of 2892 2740 mgmtagent.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 21 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mgmtagent.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mgmtagent.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00cd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mgmtagent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0259B94D-9A58-4CC3-AA69-93CEB320489E} mgmtagent.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0259B94D-9A58-4CC3-AA69-93CEB320489E}\WpadNetworkName = "Network 3" mgmtagent.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mgmtagent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mgmtagent.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0259B94D-9A58-4CC3-AA69-93CEB320489E}\WpadDecisionReason = "1" mgmtagent.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0259B94D-9A58-4CC3-AA69-93CEB320489E}\WpadDecisionTime = 60990e8b4898da01 mgmtagent.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-3e-b5-d5-ce-ce\WpadDecisionTime = 60990e8b4898da01 mgmtagent.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0259B94D-9A58-4CC3-AA69-93CEB320489E}\WpadDecision = "0" mgmtagent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-3e-b5-d5-ce-ce mgmtagent.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-3e-b5-d5-ce-ce\WpadDecision = "0" mgmtagent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mgmtagent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mgmtagent.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mgmtagent.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mgmtagent.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mgmtagent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mgmtagent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0259B94D-9A58-4CC3-AA69-93CEB320489E}\ee-3e-b5-d5-ce-ce mgmtagent.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-3e-b5-d5-ce-ce\WpadDecisionReason = "1" mgmtagent.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2892 mgmtagent.exe 2892 mgmtagent.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3000 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1824 wrote to memory of 940 1824 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 28 PID 1824 wrote to memory of 940 1824 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 28 PID 1824 wrote to memory of 940 1824 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 28 PID 1824 wrote to memory of 940 1824 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 28 PID 1824 wrote to memory of 940 1824 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 28 PID 1824 wrote to memory of 940 1824 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 28 PID 1824 wrote to memory of 940 1824 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 28 PID 1824 wrote to memory of 940 1824 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 28 PID 1824 wrote to memory of 940 1824 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 28 PID 940 wrote to memory of 2028 940 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 29 PID 940 wrote to memory of 2028 940 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 29 PID 940 wrote to memory of 2028 940 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 29 PID 940 wrote to memory of 2028 940 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 29 PID 2028 wrote to memory of 3000 2028 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 30 PID 2028 wrote to memory of 3000 2028 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 30 PID 2028 wrote to memory of 3000 2028 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 30 PID 2028 wrote to memory of 3000 2028 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 30 PID 2028 wrote to memory of 3000 2028 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 30 PID 2028 wrote to memory of 3000 2028 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 30 PID 2028 wrote to memory of 3000 2028 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 30 PID 2028 wrote to memory of 3000 2028 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 30 PID 2028 wrote to memory of 3000 2028 022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2760 2700 mgmtagent.exe 32 PID 2700 wrote to memory of 2760 2700 mgmtagent.exe 32 PID 2700 wrote to memory of 2760 2700 mgmtagent.exe 32 PID 2700 wrote to memory of 2760 2700 mgmtagent.exe 32 PID 2700 wrote to memory of 2760 2700 mgmtagent.exe 32 PID 2700 wrote to memory of 2760 2700 mgmtagent.exe 32 PID 2700 wrote to memory of 2760 2700 mgmtagent.exe 32 PID 2700 wrote to memory of 2760 2700 mgmtagent.exe 32 PID 2700 wrote to memory of 2760 2700 mgmtagent.exe 32 PID 2760 wrote to memory of 2740 2760 mgmtagent.exe 33 PID 2760 wrote to memory of 2740 2760 mgmtagent.exe 33 PID 2760 wrote to memory of 2740 2760 mgmtagent.exe 33 PID 2760 wrote to memory of 2740 2760 mgmtagent.exe 33 PID 2740 wrote to memory of 2892 2740 mgmtagent.exe 34 PID 2740 wrote to memory of 2892 2740 mgmtagent.exe 34 PID 2740 wrote to memory of 2892 2740 mgmtagent.exe 34 PID 2740 wrote to memory of 2892 2740 mgmtagent.exe 34 PID 2740 wrote to memory of 2892 2740 mgmtagent.exe 34 PID 2740 wrote to memory of 2892 2740 mgmtagent.exe 34 PID 2740 wrote to memory of 2892 2740 mgmtagent.exe 34 PID 2740 wrote to memory of 2892 2740 mgmtagent.exe 34 PID 2740 wrote to memory of 2892 2740 mgmtagent.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\022ef8c1dffca4f9ead73c61a265098f_JaffaCakes118.exe"4⤵
- Suspicious behavior: RenamesItself
PID:3000
-
-
-
-
C:\Windows\SysWOW64\mgmtagent.exeC:\Windows\SysWOW64\mgmtagent.exe1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\mgmtagent.exeC:\Windows\SysWOW64\mgmtagent.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\mgmtagent.exe"C:\Windows\SysWOW64\mgmtagent.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\mgmtagent.exe"C:\Windows\SysWOW64\mgmtagent.exe"4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2892
-
-
-