Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 18:07
Behavioral task
behavioral1
Sample
56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe
Resource
win7-20231129-en
8 signatures
150 seconds
General
-
Target
56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe
-
Size
107KB
-
MD5
56184739904c33d1d87d61683e74aef6
-
SHA1
eba058ef82d4c041f3d75991d2acb988f1b7ab91
-
SHA256
5287361ac97c294cef2bafc394444142d733388e91aa60cc99ee59f3e76f06fd
-
SHA512
f4ac11a9438071626e5d9b04f0d562a9a5bdc267b05d163539ffd499e86232fb4cfd67910032e36203ba21a601b24917f9e3d1ea7367d76b51659389233d0997
-
SSDEEP
3072:t6pqYiM+Gyg67r9Lz5rPCUyP9enOFw5p1x:QpOM+s6f9Ld9ln8g
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
slidematrix.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat slidematrix.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
slidematrix.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 slidematrix.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 slidematrix.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad slidematrix.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 slidematrix.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FC485B8B-F168-49B2-94FA-9609D2448111}\WpadDecisionTime = 302e264d4ea9da01 slidematrix.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FC485B8B-F168-49B2-94FA-9609D2448111}\c6-41-54-19-fa-1c slidematrix.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-41-54-19-fa-1c\WpadDecisionTime = 302e264d4ea9da01 slidematrix.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections slidematrix.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" slidematrix.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings slidematrix.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FC485B8B-F168-49B2-94FA-9609D2448111}\WpadDecision = "0" slidematrix.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-41-54-19-fa-1c\WpadDecision = "0" slidematrix.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix slidematrix.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" slidematrix.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FC485B8B-F168-49B2-94FA-9609D2448111} slidematrix.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FC485B8B-F168-49B2-94FA-9609D2448111}\WpadDecisionReason = "1" slidematrix.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-41-54-19-fa-1c slidematrix.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-41-54-19-fa-1c\WpadDecisionReason = "1" slidematrix.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" slidematrix.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FC485B8B-F168-49B2-94FA-9609D2448111}\WpadNetworkName = "Network 3" slidematrix.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings slidematrix.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
slidematrix.exepid process 2376 slidematrix.exe 2376 slidematrix.exe 2376 slidematrix.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
56184739904c33d1d87d61683e74aef6_JaffaCakes118.exepid process 2316 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe56184739904c33d1d87d61683e74aef6_JaffaCakes118.exeslidematrix.exeslidematrix.exepid process 1680 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe 2316 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe 1644 slidematrix.exe 2376 slidematrix.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
56184739904c33d1d87d61683e74aef6_JaffaCakes118.exeslidematrix.exedescription pid process target process PID 1680 wrote to memory of 2316 1680 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe PID 1680 wrote to memory of 2316 1680 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe PID 1680 wrote to memory of 2316 1680 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe PID 1680 wrote to memory of 2316 1680 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe PID 1644 wrote to memory of 2376 1644 slidematrix.exe slidematrix.exe PID 1644 wrote to memory of 2376 1644 slidematrix.exe slidematrix.exe PID 1644 wrote to memory of 2376 1644 slidematrix.exe slidematrix.exe PID 1644 wrote to memory of 2376 1644 slidematrix.exe slidematrix.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe--d07d4d512⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\slidematrix.exe"C:\Windows\SysWOW64\slidematrix.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\slidematrix.exe--72f583a82⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1644-4-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1680-0-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1680-2-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1680-1-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/2316-3-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2316-5-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2376-6-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2376-7-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2376-8-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2376-9-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB