Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 14:17
Static task
static1
Behavioral task
behavioral1
Sample
5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe
-
Size
477KB
-
MD5
5524511b34816ee595b195eebe2495bb
-
SHA1
4addb2bde53dbb7a04b2e136c3d93cf75f36adaf
-
SHA256
63bd217be3952557996bc345d669c76d83a8e1af58dab83ec6365ecfacd3d469
-
SHA512
01ec817cbbcf0428a8dd44e838ab506eafe9eeacc44dfd65b8b225156baaf58980cc46bad06552ad309369a1f29fe302eef59cb70bf60e9519e8e74230bb82ef
-
SSDEEP
6144:VTphC6SMy1ioBj48nVyjfJ68TBaKD1YUSxy7fMP5oKB3DS1bD:JC6SMOLFEx/TBaKWw1bD
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
exampleplugins.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat exampleplugins.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 19 IoCs
Processes:
exampleplugins.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" exampleplugins.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 exampleplugins.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 exampleplugins.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-a0-1b-12-5d-0f\WpadDecisionReason = "1" exampleplugins.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-a0-1b-12-5d-0f\WpadDecision = "0" exampleplugins.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings exampleplugins.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections exampleplugins.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 exampleplugins.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{422179D4-9369-4581-AC8F-0C0DC1EBBFEB}\WpadDecisionTime = 206193282ea9da01 exampleplugins.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-a0-1b-12-5d-0f exampleplugins.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{422179D4-9369-4581-AC8F-0C0DC1EBBFEB}\c6-a0-1b-12-5d-0f exampleplugins.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-a0-1b-12-5d-0f\WpadDetectedUrl exampleplugins.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad exampleplugins.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{422179D4-9369-4581-AC8F-0C0DC1EBBFEB}\WpadDecisionReason = "1" exampleplugins.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{422179D4-9369-4581-AC8F-0C0DC1EBBFEB}\WpadDecision = "0" exampleplugins.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{422179D4-9369-4581-AC8F-0C0DC1EBBFEB}\WpadNetworkName = "Network 3" exampleplugins.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-a0-1b-12-5d-0f\WpadDecisionTime = 206193282ea9da01 exampleplugins.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings exampleplugins.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{422179D4-9369-4581-AC8F-0C0DC1EBBFEB} exampleplugins.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe5524511b34816ee595b195eebe2495bb_JaffaCakes118.exeexampleplugins.exeexampleplugins.exepid process 2148 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe 3004 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe 2688 exampleplugins.exe 2708 exampleplugins.exe 2708 exampleplugins.exe 2708 exampleplugins.exe 2708 exampleplugins.exe 2708 exampleplugins.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
5524511b34816ee595b195eebe2495bb_JaffaCakes118.exepid process 3004 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
5524511b34816ee595b195eebe2495bb_JaffaCakes118.exeexampleplugins.exedescription pid process target process PID 2148 wrote to memory of 3004 2148 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe PID 2148 wrote to memory of 3004 2148 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe PID 2148 wrote to memory of 3004 2148 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe PID 2148 wrote to memory of 3004 2148 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe 5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe PID 2688 wrote to memory of 2708 2688 exampleplugins.exe exampleplugins.exe PID 2688 wrote to memory of 2708 2688 exampleplugins.exe exampleplugins.exe PID 2688 wrote to memory of 2708 2688 exampleplugins.exe exampleplugins.exe PID 2688 wrote to memory of 2708 2688 exampleplugins.exe exampleplugins.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5524511b34816ee595b195eebe2495bb_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\exampleplugins.exe"C:\Windows\SysWOW64\exampleplugins.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\exampleplugins.exe"C:\Windows\SysWOW64\exampleplugins.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2148-6-0x00000000001D0000-0x00000000001E6000-memory.dmpFilesize
88KB
-
memory/2148-2-0x00000000001D0000-0x00000000001E6000-memory.dmpFilesize
88KB
-
memory/2148-7-0x00000000001F0000-0x0000000000200000-memory.dmpFilesize
64KB
-
memory/2148-1-0x00000000001B0000-0x00000000001C6000-memory.dmpFilesize
88KB
-
memory/2148-16-0x00000000001B0000-0x00000000001C6000-memory.dmpFilesize
88KB
-
memory/2688-22-0x00000000002E0000-0x00000000002F6000-memory.dmpFilesize
88KB
-
memory/2688-30-0x0000000000160000-0x0000000000170000-memory.dmpFilesize
64KB
-
memory/2688-18-0x00000000002E0000-0x00000000002F6000-memory.dmpFilesize
88KB
-
memory/2688-23-0x0000000000270000-0x0000000000286000-memory.dmpFilesize
88KB
-
memory/2708-25-0x0000000000430000-0x0000000000446000-memory.dmpFilesize
88KB
-
memory/2708-29-0x0000000000430000-0x0000000000446000-memory.dmpFilesize
88KB
-
memory/3004-14-0x0000000000120000-0x0000000000136000-memory.dmpFilesize
88KB
-
memory/3004-15-0x0000000000140000-0x0000000000150000-memory.dmpFilesize
64KB
-
memory/3004-9-0x00000000001D0000-0x00000000001E6000-memory.dmpFilesize
88KB
-
memory/3004-13-0x00000000001D0000-0x00000000001E6000-memory.dmpFilesize
88KB
-
memory/3004-31-0x0000000000E30000-0x0000000000EAC000-memory.dmpFilesize
496KB
-
memory/3004-32-0x0000000000120000-0x0000000000136000-memory.dmpFilesize
88KB