Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 09:25
Static task
static1
Behavioral task
behavioral1
Sample
c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe
-
Size
4.1MB
-
MD5
c0708d42e4987f1aa26818c3cae29862
-
SHA1
0d80791612deb086109101d5b42a2b7afe84c23c
-
SHA256
ca2c001a46eda58f4d32fab9f2ea670bc6e3cb6f6e7f50521f5e90bedcba2d0e
-
SHA512
4c087150555540dc405308241b2a09297fe77ea8f5f93df9da907ecc832fa896abcdcac1a498455cc641aa30c99cccea29ebababdeec3d38cdd2d23ae7b3ff59
-
SSDEEP
98304:+R0pI/IQlUoMPdmpSpQ4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmL5n9klRKN41v
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2004 xbodec.exe -
Loads dropped DLL 1 IoCs
pid Process 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidIH\\optixec.exe" c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesX2\\xbodec.exe" c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 2004 xbodec.exe 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2004 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 28 PID 2212 wrote to memory of 2004 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 28 PID 2212 wrote to memory of 2004 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 28 PID 2212 wrote to memory of 2004 2212 c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c0708d42e4987f1aa26818c3cae29862_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\FilesX2\xbodec.exeC:\FilesX2\xbodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198B
MD5811e28edc9d610e688c4c5dee7a167b0
SHA13388b49acaea5af62ccef9e9057ddc6b26352941
SHA256ef8ae55e32eda233193f6d4486ca8c8d32eab44c70494f8cc8cec224ee0dd167
SHA512d0b6d99d4a1dcbaf310dde9b5718f6b3c2d5b9112c72dfe997b9c5987321a03cd12f1212e8a95127885275b74c38cd131d227660ef4318f5c628140a6a9bbef5
-
Filesize
4.1MB
MD5c9430e9f9aa315aafb0ffc31d9542cf2
SHA15858d3576951a98453e006d8e6ce7264d9d4800d
SHA2565123f6d559b309cd5f5747c1f0510277754fe9d01f185616ef0f48754c754eed
SHA5127eb25fcad1c1607aca4b9ad557871559e1a0dce909f621ab9197694f18e664b96155199d144af963ed830ecc60d117e354a97189827a43750079986cca90a96d
-
Filesize
4.1MB
MD56891b2724727d4a31edcedb55fa2a65b
SHA1bb517d736c0a3ba101dde8592bebab5a3135c7bd
SHA256f19aad9935e788c09348ea81320f6c06c6ab3bcae120cd14e047aae8ee683b35
SHA512af7902051bd5c3e71ec8aefc85e6b9a06fec103eb9abaf58d42c7db50b56eb0f307c364b38c0f1f9dce569bbb1cb0079602698094f225244531996440c3fdd3c