Analysis
-
max time kernel
132s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 21:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe
-
Size
415KB
-
MD5
5b756df503196e5ca1a7ac86c34f4477
-
SHA1
333f7c630a0c4d9297d39935c72dd07a746a62eb
-
SHA256
36306ac5cc44402bc147184c87c4d2e287e9d1ad9a2dc89b062a448538a1b7a5
-
SHA512
ad5ca3c1a65ceff34850140d47ccd877c5535785216960fb74aed04aaa05d7f8fa0914c0c9f4f70bb3bc5acb581afada6f5f38b7e70fcdfcf5be09979745ba49
-
SSDEEP
6144:GVlVgitrbq3Z56l7f5UO8A4BU5hW5GyX0+:GVowrbq3C7BcU5hWrk+
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
ascentry.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat ascentry.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 18 IoCs
Processes:
ascentry.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\WpadDecisionTime = f0ff152f30aada01 ascentry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\72-16-0e-00-7c-ec ascentry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" ascentry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4} ascentry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-16-0e-00-7c-ec\WpadDecision = "0" ascentry.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ascentry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings ascentry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad ascentry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\WpadDecisionReason = "1" ascentry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ascentry.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ascentry.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ascentry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\WpadDecision = "0" ascentry.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\WpadNetworkName = "Network 3" ascentry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-16-0e-00-7c-ec ascentry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-16-0e-00-7c-ec\WpadDecisionReason = "1" ascentry.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-16-0e-00-7c-ec\WpadDecisionTime = f0ff152f30aada01 ascentry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ascentry.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exeascentry.exeascentry.exepid process 2032 5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe 1716 5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe 2208 ascentry.exe 2780 ascentry.exe 2780 ascentry.exe 2780 ascentry.exe 2780 ascentry.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exepid process 1716 5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exeascentry.exedescription pid process target process PID 2032 wrote to memory of 1716 2032 5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe 5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe PID 2032 wrote to memory of 1716 2032 5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe 5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe PID 2032 wrote to memory of 1716 2032 5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe 5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe PID 2032 wrote to memory of 1716 2032 5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe 5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe PID 2208 wrote to memory of 2780 2208 ascentry.exe ascentry.exe PID 2208 wrote to memory of 2780 2208 ascentry.exe ascentry.exe PID 2208 wrote to memory of 2780 2208 ascentry.exe ascentry.exe PID 2208 wrote to memory of 2780 2208 ascentry.exe ascentry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5b756df503196e5ca1a7ac86c34f4477_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\ascentry.exe"C:\Windows\SysWOW64\ascentry.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ascentry.exe"C:\Windows\SysWOW64\ascentry.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1716-9-0x00000000002F0000-0x0000000000306000-memory.dmpFilesize
88KB
-
memory/1716-5-0x00000000002F0000-0x0000000000306000-memory.dmpFilesize
88KB
-
memory/2032-4-0x0000000000270000-0x0000000000286000-memory.dmpFilesize
88KB
-
memory/2032-10-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2032-0-0x0000000000270000-0x0000000000286000-memory.dmpFilesize
88KB
-
memory/2208-15-0x00000000003B0000-0x00000000003C6000-memory.dmpFilesize
88KB
-
memory/2208-11-0x00000000003B0000-0x00000000003C6000-memory.dmpFilesize
88KB
-
memory/2780-16-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/2780-20-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB