Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 22:42
Static task
static1
Behavioral task
behavioral1
Sample
5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
5bdbbf93a251e673d68d66cb50bf2d72
-
SHA1
e38d499d9f4d9694d6bb7027e5f103729416aac4
-
SHA256
a66d95aff5675c60665249145aeabd82d6391212064787b1e9842fc9af1138e3
-
SHA512
bff46116d2e675b557cf48fd0ae21a04e65e60d202e73614d11fa0d74179be2dfa899df2dd995f2a524ae41f7cb2613b7a4f245f355276f78246cc8107963254
-
SSDEEP
24576:D2uZd7yv0Aj3GICxc0XFByaZkLM38BqfNaE0Dy8FTSn0X8nhk0npgb:Dtf7yvpj21xc0XreQ3JwTS0XxGpg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
driver.exepid process 1756 driver.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 24 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
Processes:
5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exedriver.exepid process 1184 5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe 1184 5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4752 schtasks.exe 1804 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
driver.exepid process 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe 1756 driver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
driver.exedescription pid process Token: SeDebugPrivilege 1756 driver.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exedriver.exepid process 1184 5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe 1756 driver.exe 1756 driver.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exedriver.exedescription pid process target process PID 1184 wrote to memory of 1804 1184 5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe schtasks.exe PID 1184 wrote to memory of 1804 1184 5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe schtasks.exe PID 1184 wrote to memory of 1804 1184 5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe schtasks.exe PID 1184 wrote to memory of 1756 1184 5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe driver.exe PID 1184 wrote to memory of 1756 1184 5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe driver.exe PID 1184 wrote to memory of 1756 1184 5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe driver.exe PID 1756 wrote to memory of 4752 1756 driver.exe schtasks.exe PID 1756 wrote to memory of 4752 1756 driver.exe schtasks.exe PID 1756 wrote to memory of 4752 1756 driver.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\driver\driver.exe"C:\Users\Admin\AppData\Roaming\driver\driver.exe" -d22⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\driver\driver.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\driver\driver.exeFilesize
1.2MB
MD55bdbbf93a251e673d68d66cb50bf2d72
SHA1e38d499d9f4d9694d6bb7027e5f103729416aac4
SHA256a66d95aff5675c60665249145aeabd82d6391212064787b1e9842fc9af1138e3
SHA512bff46116d2e675b557cf48fd0ae21a04e65e60d202e73614d11fa0d74179be2dfa899df2dd995f2a524ae41f7cb2613b7a4f245f355276f78246cc8107963254
-
memory/1184-15-0x0000000074850000-0x0000000075000000-memory.dmpFilesize
7.7MB
-
memory/1184-2-0x0000000000E60000-0x000000000121E000-memory.dmpFilesize
3.7MB
-
memory/1184-3-0x0000000074850000-0x0000000075000000-memory.dmpFilesize
7.7MB
-
memory/1184-4-0x0000000006190000-0x00000000061F6000-memory.dmpFilesize
408KB
-
memory/1184-5-0x0000000006D70000-0x0000000007314000-memory.dmpFilesize
5.6MB
-
memory/1184-1-0x000000007485E000-0x000000007485F000-memory.dmpFilesize
4KB
-
memory/1184-9-0x00000000069C0000-0x0000000006A52000-memory.dmpFilesize
584KB
-
memory/1184-14-0x0000000000E60000-0x000000000121E000-memory.dmpFilesize
3.7MB
-
memory/1184-0-0x0000000000E60000-0x000000000121E000-memory.dmpFilesize
3.7MB
-
memory/1756-26-0x0000000074850000-0x0000000075000000-memory.dmpFilesize
7.7MB
-
memory/1756-10-0x00000000004C0000-0x000000000087E000-memory.dmpFilesize
3.7MB
-
memory/1756-18-0x0000000074850000-0x0000000075000000-memory.dmpFilesize
7.7MB
-
memory/1756-17-0x00000000004C0000-0x000000000087E000-memory.dmpFilesize
3.7MB
-
memory/1756-19-0x0000000074850000-0x0000000075000000-memory.dmpFilesize
7.7MB
-
memory/1756-20-0x0000000005D10000-0x0000000005D22000-memory.dmpFilesize
72KB
-
memory/1756-21-0x0000000006390000-0x00000000063CC000-memory.dmpFilesize
240KB
-
memory/1756-23-0x0000000006850000-0x000000000685A000-memory.dmpFilesize
40KB
-
memory/1756-28-0x0000000074850000-0x0000000075000000-memory.dmpFilesize
7.7MB
-
memory/1756-27-0x00000000004C0000-0x000000000087E000-memory.dmpFilesize
3.7MB
-
memory/1756-16-0x00000000004C0000-0x000000000087E000-memory.dmpFilesize
3.7MB