Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 12:27
Static task
static1
Behavioral task
behavioral1
Sample
634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe
-
Size
380KB
-
MD5
634abd29ab5f0ca9608ba660f6518f31
-
SHA1
4cb24f4e8020a603f950de37fd6f2a4418796bdc
-
SHA256
14228af808c89b5e1fe2229e512bd036e33fbabea3b2a90ba8f884fe8c6c7357
-
SHA512
a1111877ce348931cc4037bd0798f4947557379a7390948c61841391db623960475ae14812309d6bd01916fb4f9b4cea27b8f684bb54b268ff725f4c6d99445a
-
SSDEEP
3072:/OvSgKVssaHwsdVXBVb4hssL86Qzrsut0e/x5J/JPBOysL5smLy/+dIL:/OvSnVywsdbzK6P/xhBKLo
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
graphrule.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat graphrule.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 19 IoCs
Processes:
graphrule.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E345AFA-3B2B-4AC6-BFB8-DA93A76BB292}\WpadNetworkName = "Network 3" graphrule.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-d6-80-27-fd-8e\WpadDecisionTime = 4086a55a7aabda01 graphrule.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-d6-80-27-fd-8e\WpadDecision = "0" graphrule.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-d6-80-27-fd-8e\WpadDetectedUrl graphrule.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings graphrule.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad graphrule.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E345AFA-3B2B-4AC6-BFB8-DA93A76BB292}\WpadDecisionReason = "1" graphrule.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E345AFA-3B2B-4AC6-BFB8-DA93A76BB292}\WpadDecisionTime = 4086a55a7aabda01 graphrule.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 graphrule.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 graphrule.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings graphrule.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" graphrule.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E345AFA-3B2B-4AC6-BFB8-DA93A76BB292} graphrule.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E345AFA-3B2B-4AC6-BFB8-DA93A76BB292}\WpadDecision = "0" graphrule.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-d6-80-27-fd-8e graphrule.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E345AFA-3B2B-4AC6-BFB8-DA93A76BB292}\f6-d6-80-27-fd-8e graphrule.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections graphrule.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 graphrule.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-d6-80-27-fd-8e\WpadDecisionReason = "1" graphrule.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exegraphrule.exegraphrule.exepid process 1688 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe 2300 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe 2652 graphrule.exe 2740 graphrule.exe 2740 graphrule.exe 2740 graphrule.exe 2740 graphrule.exe 2740 graphrule.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exepid process 2300 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exegraphrule.exedescription pid process target process PID 1688 wrote to memory of 2300 1688 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe PID 1688 wrote to memory of 2300 1688 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe PID 1688 wrote to memory of 2300 1688 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe PID 1688 wrote to memory of 2300 1688 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe 634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe PID 2652 wrote to memory of 2740 2652 graphrule.exe graphrule.exe PID 2652 wrote to memory of 2740 2652 graphrule.exe graphrule.exe PID 2652 wrote to memory of 2740 2652 graphrule.exe graphrule.exe PID 2652 wrote to memory of 2740 2652 graphrule.exe graphrule.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\634abd29ab5f0ca9608ba660f6518f31_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2300
-
C:\Windows\SysWOW64\graphrule.exe"C:\Windows\SysWOW64\graphrule.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\graphrule.exe"C:\Windows\SysWOW64\graphrule.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1688-6-0x0000000000270000-0x0000000000280000-memory.dmpFilesize
64KB
-
memory/1688-5-0x0000000000320000-0x0000000000337000-memory.dmpFilesize
92KB
-
memory/1688-0-0x0000000000340000-0x0000000000357000-memory.dmpFilesize
92KB
-
memory/1688-14-0x0000000000320000-0x0000000000337000-memory.dmpFilesize
92KB
-
memory/1688-4-0x0000000000340000-0x0000000000357000-memory.dmpFilesize
92KB
-
memory/2300-29-0x00000000008C0000-0x0000000000925000-memory.dmpFilesize
404KB
-
memory/2300-11-0x0000000000270000-0x0000000000287000-memory.dmpFilesize
92KB
-
memory/2300-7-0x0000000000270000-0x0000000000287000-memory.dmpFilesize
92KB
-
memory/2300-13-0x0000000000290000-0x00000000002A0000-memory.dmpFilesize
64KB
-
memory/2300-12-0x0000000000250000-0x0000000000267000-memory.dmpFilesize
92KB
-
memory/2300-30-0x0000000000250000-0x0000000000267000-memory.dmpFilesize
92KB
-
memory/2652-15-0x0000000000340000-0x0000000000357000-memory.dmpFilesize
92KB
-
memory/2652-20-0x0000000000320000-0x0000000000337000-memory.dmpFilesize
92KB
-
memory/2652-21-0x0000000000840000-0x0000000000850000-memory.dmpFilesize
64KB
-
memory/2652-19-0x0000000000340000-0x0000000000357000-memory.dmpFilesize
92KB
-
memory/2740-26-0x0000000000500000-0x0000000000517000-memory.dmpFilesize
92KB
-
memory/2740-22-0x0000000000500000-0x0000000000517000-memory.dmpFilesize
92KB
-
memory/2740-28-0x0000000000330000-0x0000000000340000-memory.dmpFilesize
64KB
-
memory/2740-27-0x0000000000310000-0x0000000000327000-memory.dmpFilesize
92KB
-
memory/2740-31-0x0000000000310000-0x0000000000327000-memory.dmpFilesize
92KB