Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 18:15
Behavioral task
behavioral1
Sample
3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe
-
Size
109KB
-
MD5
3066d1b2e84e8444082d70a1ad90c017
-
SHA1
3bd522bd7256095774f78ba98ea0f4085651b88a
-
SHA256
61ffe36301e722b85088cfceb5d5a703e57eff907119ef305dc92da45c254aaf
-
SHA512
84c61d702d184538cbdac5d99ae18cc9abd6aef456db3133fb1a694aca2947683f098d6601964c633c274358b9b510761e6afee8adfaea03e23609cd654a8fc9
-
SSDEEP
3072:OCrRG9LEWHyMp6awrpEoNLna7EP7S5p1gRk:OCrs0JaYvnDPgg2
Malware Config
Signatures
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 177.231.157.189 Destination IP 177.231.157.189 -
Drops file in System32 directory 1 IoCs
Processes:
idebugrelated.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat idebugrelated.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
idebugrelated.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections idebugrelated.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 idebugrelated.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" idebugrelated.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 idebugrelated.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-9e-9e-90-35-58 idebugrelated.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings idebugrelated.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8845843-6AE7-4815-B3FF-9BEB2A8258E5}\WpadDecisionReason = "1" idebugrelated.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8845843-6AE7-4815-B3FF-9BEB2A8258E5}\WpadDecision = "0" idebugrelated.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8845843-6AE7-4815-B3FF-9BEB2A8258E5}\WpadNetworkName = "Network 3" idebugrelated.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8845843-6AE7-4815-B3FF-9BEB2A8258E5}\WpadDecisionTime = 9061c72f06a3da01 idebugrelated.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-9e-9e-90-35-58\WpadDecisionReason = "1" idebugrelated.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix idebugrelated.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" idebugrelated.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings idebugrelated.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" idebugrelated.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 idebugrelated.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad idebugrelated.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8845843-6AE7-4815-B3FF-9BEB2A8258E5} idebugrelated.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8845843-6AE7-4815-B3FF-9BEB2A8258E5}\12-9e-9e-90-35-58 idebugrelated.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-9e-9e-90-35-58\WpadDecisionTime = 9061c72f06a3da01 idebugrelated.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-9e-9e-90-35-58\WpadDecision = "0" idebugrelated.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
idebugrelated.exepid process 2632 idebugrelated.exe 2632 idebugrelated.exe 2632 idebugrelated.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exepid process 3008 3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exeidebugrelated.exeidebugrelated.exepid process 2744 3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe 3008 3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe 2548 idebugrelated.exe 2632 idebugrelated.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exeidebugrelated.exedescription pid process target process PID 2744 wrote to memory of 3008 2744 3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe 3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe PID 2744 wrote to memory of 3008 2744 3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe 3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe PID 2744 wrote to memory of 3008 2744 3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe 3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe PID 2744 wrote to memory of 3008 2744 3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe 3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe PID 2548 wrote to memory of 2632 2548 idebugrelated.exe idebugrelated.exe PID 2548 wrote to memory of 2632 2548 idebugrelated.exe idebugrelated.exe PID 2548 wrote to memory of 2632 2548 idebugrelated.exe idebugrelated.exe PID 2548 wrote to memory of 2632 2548 idebugrelated.exe idebugrelated.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3066d1b2e84e8444082d70a1ad90c017_JaffaCakes118.exe--57754af62⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\idebugrelated.exe"C:\Windows\SysWOW64\idebugrelated.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\idebugrelated.exe--fee5f4d72⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2548-6-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2632-8-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2632-9-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2632-10-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2632-11-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2744-0-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/2744-1-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2744-2-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/2744-3-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3008-4-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3008-5-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3008-7-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB