Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 22:18
Static task
static1
Behavioral task
behavioral1
Sample
26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe
-
Size
499KB
-
MD5
26fec1e25a99f0cee5e40a4cac55ea00
-
SHA1
184569c0e12c327183427c45d18daa8df89bcc33
-
SHA256
3c8030b45d07bafb36023df5de15f6a02a461f1ed73dbe7eb4e678bad20e718f
-
SHA512
4a328761596c5f7720ef1397427bb45c7ec22eda176d745ef46b3fd3133e667773a38b6a44e5c29ca669f0a7784818a9aa239a7d11fcc6a73d7e3c6afff4a2f9
-
SSDEEP
6144:q9xxtqe+fXzVuMCUJN9/hU7d8NAXxOuoORByciYJXI+Oq:Mx7H+fXz6UVhgjBOuoORBylYJ4
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat horzdynamic.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 19 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 horzdynamic.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AB41B090-1277-4DB7-B7B7-F9A3D6B4E3F6} horzdynamic.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AB41B090-1277-4DB7-B7B7-F9A3D6B4E3F6}\WpadNetworkName = "Network 3" horzdynamic.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-87-0e-97-9c-0b\WpadDecisionReason = "1" horzdynamic.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AB41B090-1277-4DB7-B7B7-F9A3D6B4E3F6}\7e-87-0e-97-9c-0b horzdynamic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-87-0e-97-9c-0b\WpadDecisionTime = 00462aae95a1da01 horzdynamic.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-87-0e-97-9c-0b\WpadDecision = "0" horzdynamic.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings horzdynamic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings horzdynamic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad horzdynamic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AB41B090-1277-4DB7-B7B7-F9A3D6B4E3F6}\WpadDecisionTime = 00462aae95a1da01 horzdynamic.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-87-0e-97-9c-0b\WpadDetectedUrl horzdynamic.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" horzdynamic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 horzdynamic.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AB41B090-1277-4DB7-B7B7-F9A3D6B4E3F6}\WpadDecision = "0" horzdynamic.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-87-0e-97-9c-0b horzdynamic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections horzdynamic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 horzdynamic.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AB41B090-1277-4DB7-B7B7-F9A3D6B4E3F6}\WpadDecisionReason = "1" horzdynamic.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1676 26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe 2236 26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe 2584 horzdynamic.exe 2648 horzdynamic.exe 2648 horzdynamic.exe 2648 horzdynamic.exe 2648 horzdynamic.exe 2648 horzdynamic.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2236 26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2236 1676 26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe 28 PID 1676 wrote to memory of 2236 1676 26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe 28 PID 1676 wrote to memory of 2236 1676 26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe 28 PID 1676 wrote to memory of 2236 1676 26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe 28 PID 2584 wrote to memory of 2648 2584 horzdynamic.exe 30 PID 2584 wrote to memory of 2648 2584 horzdynamic.exe 30 PID 2584 wrote to memory of 2648 2584 horzdynamic.exe 30 PID 2584 wrote to memory of 2648 2584 horzdynamic.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\26fec1e25a99f0cee5e40a4cac55ea00_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2236
-
-
C:\Windows\SysWOW64\horzdynamic.exe"C:\Windows\SysWOW64\horzdynamic.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\horzdynamic.exe"C:\Windows\SysWOW64\horzdynamic.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2648
-