Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 18:07
Behavioral task
behavioral1
Sample
56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe
Resource
win7-20231129-en
8 signatures
150 seconds
General
-
Target
56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe
-
Size
107KB
-
MD5
56184739904c33d1d87d61683e74aef6
-
SHA1
eba058ef82d4c041f3d75991d2acb988f1b7ab91
-
SHA256
5287361ac97c294cef2bafc394444142d733388e91aa60cc99ee59f3e76f06fd
-
SHA512
f4ac11a9438071626e5d9b04f0d562a9a5bdc267b05d163539ffd499e86232fb4cfd67910032e36203ba21a601b24917f9e3d1ea7367d76b51659389233d0997
-
SSDEEP
3072:t6pqYiM+Gyg67r9Lz5rPCUyP9enOFw5p1x:QpOM+s6f9Ld9ln8g
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
Processes:
randombit.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 randombit.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE randombit.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies randombit.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 randombit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
randombit.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" randombit.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" randombit.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix randombit.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
randombit.exepid process 2256 randombit.exe 2256 randombit.exe 2256 randombit.exe 2256 randombit.exe 2256 randombit.exe 2256 randombit.exe 2256 randombit.exe 2256 randombit.exe 2256 randombit.exe 2256 randombit.exe 2256 randombit.exe 2256 randombit.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
56184739904c33d1d87d61683e74aef6_JaffaCakes118.exepid process 768 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
56184739904c33d1d87d61683e74aef6_JaffaCakes118.exerandombit.exedescription pid process target process PID 3032 wrote to memory of 768 3032 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe PID 3032 wrote to memory of 768 3032 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe PID 3032 wrote to memory of 768 3032 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe 56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe PID 632 wrote to memory of 2256 632 randombit.exe randombit.exe PID 632 wrote to memory of 2256 632 randombit.exe randombit.exe PID 632 wrote to memory of 2256 632 randombit.exe randombit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\56184739904c33d1d87d61683e74aef6_JaffaCakes118.exe--d07d4d512⤵
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\randombit.exe"C:\Windows\SysWOW64\randombit.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\randombit.exe--e627a6002⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/632-6-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/632-8-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/632-14-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/768-4-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/768-10-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2256-11-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2256-12-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2256-16-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/3032-0-0x00000000004A0000-0x00000000004B1000-memory.dmpFilesize
68KB
-
memory/3032-3-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3032-2-0x00000000004A0000-0x00000000004B1000-memory.dmpFilesize
68KB