Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 02:22
Static task
static1
Behavioral task
behavioral1
Sample
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe
-
Size
893KB
-
MD5
158c84cc65140c2ee6327ad82e294af3
-
SHA1
2cdc05e4d6c0f2beca3ecc0ab3b45b66896538b2
-
SHA256
4ac320020cc130f74bed1a16e367fa883fb19be2ed742995448ad0edc2e2c952
-
SHA512
845cec3bb37fe9e3b38e7048ef2cd6294c095d244bf71b8b367c1aa4ffa4cf1804c38dea1cd33e263401e0c0e31d8583e3d36b25c974a66fc1a0b4efafb0a243
-
SSDEEP
12288:agDdArMrjqK1XXRoRk+9FUn+HGRkhumTQXYPcOvXR:agJAIn7xXR1+QkhuG53vXR
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1724-2-0x0000000000480000-0x00000000004B8000-memory.dmp family_zgrat_v1 behavioral1/memory/2464-32-0x0000000001E30000-0x0000000001E68000-memory.dmp family_zgrat_v1 -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2920 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exepid process 2464 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 2584 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Loads dropped DLL 2 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exepid process 2540 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 2464 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1724-2-0x0000000000480000-0x00000000004B8000-memory.dmp agile_net behavioral1/memory/2464-32-0x0000000001E30000-0x0000000001E68000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fintess = "\\Fitnees\\Calme.exe" 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fintess = "C:\\Users\\Admin\\AppData\\Roaming\\Fitnees\\Calme.exe" 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exedescription pid process target process PID 1724 set thread context of 2540 1724 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 2464 set thread context of 2584 2464 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exepid process 2540 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 2540 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 2540 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 2584 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 2584 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 2584 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 2584 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 2584 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exepid process 2584 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exedescription pid process Token: SeDebugPrivilege 1724 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe Token: SeDebugPrivilege 2540 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe Token: SeDebugPrivilege 2464 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe Token: SeDebugPrivilege 2584 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe Token: 33 2584 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe Token: SeIncBasePriorityPrivilege 2584 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exepid process 2584 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.execmd.exe158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exedescription pid process target process PID 1724 wrote to memory of 2540 1724 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 1724 wrote to memory of 2540 1724 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 1724 wrote to memory of 2540 1724 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 1724 wrote to memory of 2540 1724 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 1724 wrote to memory of 2540 1724 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 1724 wrote to memory of 2540 1724 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 1724 wrote to memory of 2540 1724 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 1724 wrote to memory of 2540 1724 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 1724 wrote to memory of 2540 1724 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 2540 wrote to memory of 2464 2540 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 2540 wrote to memory of 2464 2540 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 2540 wrote to memory of 2464 2540 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 2540 wrote to memory of 2464 2540 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 2540 wrote to memory of 2920 2540 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe cmd.exe PID 2540 wrote to memory of 2920 2540 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe cmd.exe PID 2540 wrote to memory of 2920 2540 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe cmd.exe PID 2540 wrote to memory of 2920 2540 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe cmd.exe PID 2920 wrote to memory of 2784 2920 cmd.exe PING.EXE PID 2920 wrote to memory of 2784 2920 cmd.exe PING.EXE PID 2920 wrote to memory of 2784 2920 cmd.exe PING.EXE PID 2920 wrote to memory of 2784 2920 cmd.exe PING.EXE PID 2464 wrote to memory of 2584 2464 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 2464 wrote to memory of 2584 2464 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 2464 wrote to memory of 2584 2464 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 2464 wrote to memory of 2584 2464 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 2464 wrote to memory of 2584 2464 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 2464 wrote to memory of 2584 2464 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 2464 wrote to memory of 2584 2464 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 2464 wrote to memory of 2584 2464 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 2464 wrote to memory of 2584 2464 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_jaffacakes118\158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_jaffacakes118\158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_jaffacakes118\158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_jaffacakes118\158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10004⤵
- Runs ping.exe
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_jaffacakes118\158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exeFilesize
893KB
MD5158c84cc65140c2ee6327ad82e294af3
SHA12cdc05e4d6c0f2beca3ecc0ab3b45b66896538b2
SHA2564ac320020cc130f74bed1a16e367fa883fb19be2ed742995448ad0edc2e2c952
SHA512845cec3bb37fe9e3b38e7048ef2cd6294c095d244bf71b8b367c1aa4ffa4cf1804c38dea1cd33e263401e0c0e31d8583e3d36b25c974a66fc1a0b4efafb0a243
-
C:\Users\Admin\AppData\Roaming\Imminent\Path.datFilesize
48B
MD5b770e04d567984960e551b9f0f66276b
SHA1304712aa2b82f84a393fc014bcdfafec55a2d923
SHA256c4e8f4af6a023b980cecdac61b5231060946b76dd053e4767cefabdb810afb9d
SHA512c601af9a4e05e9797fd2273d1a3e8618909b744e8fe8c12b5ceaabd2be19d12cfebf94abb93511fcf9ffbac9b217d894206b6e59f727bced09dffd0abffcd843
-
memory/1724-21-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB
-
memory/1724-0-0x0000000074D9E000-0x0000000074D9F000-memory.dmpFilesize
4KB
-
memory/1724-4-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB
-
memory/1724-5-0x0000000074D9E000-0x0000000074D9F000-memory.dmpFilesize
4KB
-
memory/1724-6-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB
-
memory/1724-1-0x00000000001A0000-0x0000000000284000-memory.dmpFilesize
912KB
-
memory/1724-3-0x0000000000460000-0x0000000000466000-memory.dmpFilesize
24KB
-
memory/1724-2-0x0000000000480000-0x00000000004B8000-memory.dmpFilesize
224KB
-
memory/2464-31-0x0000000000350000-0x0000000000434000-memory.dmpFilesize
912KB
-
memory/2464-32-0x0000000001E30000-0x0000000001E68000-memory.dmpFilesize
224KB
-
memory/2540-13-0x0000000000080000-0x00000000000D6000-memory.dmpFilesize
344KB
-
memory/2540-19-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB
-
memory/2540-22-0x0000000004820000-0x00000000048CE000-memory.dmpFilesize
696KB
-
memory/2540-20-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB
-
memory/2540-23-0x0000000000320000-0x0000000000348000-memory.dmpFilesize
160KB
-
memory/2540-18-0x0000000000300000-0x0000000000310000-memory.dmpFilesize
64KB
-
memory/2540-8-0x0000000000080000-0x00000000000D6000-memory.dmpFilesize
344KB
-
memory/2540-17-0x0000000000080000-0x00000000000D6000-memory.dmpFilesize
344KB
-
memory/2540-33-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB
-
memory/2540-9-0x0000000000080000-0x00000000000D6000-memory.dmpFilesize
344KB
-
memory/2584-47-0x0000000000650000-0x0000000000666000-memory.dmpFilesize
88KB