Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 11:00
Static task
static1
Behavioral task
behavioral1
Sample
630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe
-
Size
100KB
-
MD5
630e6e37778be7e5def44c4f1e5d4239
-
SHA1
b46aaacc5a471aadfcaa223227620fee243da1ed
-
SHA256
56002cdbf9ee0989f14b5bee5ca5d8fac4f4de408a1e0ad12084cd0218512b25
-
SHA512
78171467f2494733b11b88a7901969f51fe8a34563b3a5e2b954b6c3e5cd344e424b5fd865becc6be45c4c1d1b8b6ab4bbc3c56e610dc1ce032b11f843284ab9
-
SSDEEP
3072:gkc6a5ffHvXyZbmrAVy9m26gciigwEx2FePLmSIoN/rAbFHI7o/33vYu:gkMY/ETAbFHI0/
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
CustomAcc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat CustomAcc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
CustomAcc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections CustomAcc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix CustomAcc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 CustomAcc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68758131-F71B-4337-B149-E3D21C707BFB} CustomAcc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68758131-F71B-4337-B149-E3D21C707BFB}\WpadDecisionReason = "1" CustomAcc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-ac-0b-2e-eb-57 CustomAcc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings CustomAcc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" CustomAcc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings CustomAcc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad CustomAcc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68758131-F71B-4337-B149-E3D21C707BFB}\WpadDecision = "0" CustomAcc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-ac-0b-2e-eb-57\WpadDecisionTime = 50d0b5106eabda01 CustomAcc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-ac-0b-2e-eb-57\WpadDecision = "0" CustomAcc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 CustomAcc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 CustomAcc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68758131-F71B-4337-B149-E3D21C707BFB}\WpadDecisionTime = 50d0b5106eabda01 CustomAcc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68758131-F71B-4337-B149-E3D21C707BFB}\WpadNetworkName = "Network 3" CustomAcc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" CustomAcc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" CustomAcc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68758131-F71B-4337-B149-E3D21C707BFB}\7a-ac-0b-2e-eb-57 CustomAcc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-ac-0b-2e-eb-57\WpadDecisionReason = "1" CustomAcc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
CustomAcc.exepid process 2672 CustomAcc.exe 2672 CustomAcc.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exepid process 1980 630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exeCustomAcc.exedescription pid process target process PID 1700 wrote to memory of 1980 1700 630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe 630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe PID 1700 wrote to memory of 1980 1700 630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe 630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe PID 1700 wrote to memory of 1980 1700 630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe 630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe PID 1700 wrote to memory of 1980 1700 630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe 630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe PID 3044 wrote to memory of 2672 3044 CustomAcc.exe CustomAcc.exe PID 3044 wrote to memory of 2672 3044 CustomAcc.exe CustomAcc.exe PID 3044 wrote to memory of 2672 3044 CustomAcc.exe CustomAcc.exe PID 3044 wrote to memory of 2672 3044 CustomAcc.exe CustomAcc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\630e6e37778be7e5def44c4f1e5d4239_JaffaCakes118.exe"2⤵
- Suspicious behavior: RenamesItself
PID:1980
-
C:\Windows\SysWOW64\CustomAcc.exeC:\Windows\SysWOW64\CustomAcc.exe1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\CustomAcc.exe"C:\Windows\SysWOW64\CustomAcc.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1700-0-0x00000000000E0000-0x00000000000EE000-memory.dmpFilesize
56KB
-
memory/1700-5-0x0000000000120000-0x000000000012E000-memory.dmpFilesize
56KB
-
memory/1700-1-0x0000000000120000-0x000000000012E000-memory.dmpFilesize
56KB
-
memory/1700-6-0x0000000000190000-0x00000000001A0000-memory.dmpFilesize
64KB
-
memory/1700-14-0x00000000000E0000-0x00000000000EE000-memory.dmpFilesize
56KB
-
memory/1980-11-0x00000000001C0000-0x00000000001CE000-memory.dmpFilesize
56KB
-
memory/1980-7-0x00000000001C0000-0x00000000001CE000-memory.dmpFilesize
56KB
-
memory/1980-13-0x0000000000280000-0x0000000000290000-memory.dmpFilesize
64KB
-
memory/1980-12-0x0000000000070000-0x000000000007E000-memory.dmpFilesize
56KB
-
memory/1980-29-0x0000000000C30000-0x0000000000C50000-memory.dmpFilesize
128KB
-
memory/1980-30-0x0000000000070000-0x000000000007E000-memory.dmpFilesize
56KB
-
memory/2672-27-0x00000000004C0000-0x00000000004D0000-memory.dmpFilesize
64KB
-
memory/2672-21-0x00000000001B0000-0x00000000001BE000-memory.dmpFilesize
56KB
-
memory/2672-26-0x0000000000260000-0x000000000026E000-memory.dmpFilesize
56KB
-
memory/2672-22-0x0000000000260000-0x000000000026E000-memory.dmpFilesize
56KB
-
memory/2672-31-0x00000000001B0000-0x00000000001BE000-memory.dmpFilesize
56KB
-
memory/3044-20-0x0000000000140000-0x0000000000150000-memory.dmpFilesize
64KB
-
memory/3044-28-0x00000000000E0000-0x00000000000EE000-memory.dmpFilesize
56KB
-
memory/3044-15-0x0000000000130000-0x000000000013E000-memory.dmpFilesize
56KB
-
memory/3044-19-0x0000000000130000-0x000000000013E000-memory.dmpFilesize
56KB