Analysis
-
max time kernel
131s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 15:33
Static task
static1
Behavioral task
behavioral1
Sample
63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe
-
Size
172KB
-
MD5
63cca393ab309282e416f7a1dcb97dd6
-
SHA1
adf92dfee2d96be5186c5e3c4f449a00970a8998
-
SHA256
0191b05e5ce7e3b5fe92a3326ca74493be9fd9d8e31bdaefa68cbc5c9b6f62e7
-
SHA512
9dae69df205094ef5c11b560db204385db139d4b880b4ef28872bcf7b8248b6bd8e1af62ef62092a9986d9a67132e8b9c2ddc9b8aafe146173ea6a1e51202497
-
SSDEEP
3072:dwa+jvXl2YCdruDD9jiWC4dzopFFICWY86bIWLu4Nrme/1Z7:jYl7WrOiWa1
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
earconslide.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat earconslide.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 18 IoCs
Processes:
earconslide.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad earconslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F94CCB16-51A1-4C50-B23E-CC3DDCCD4A65}\WpadDecisionReason = "1" earconslide.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections earconslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" earconslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earconslide.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F94CCB16-51A1-4C50-B23E-CC3DDCCD4A65} earconslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F94CCB16-51A1-4C50-B23E-CC3DDCCD4A65}\WpadDecisionTime = 2099f13d94abda01 earconslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-ee-d0-44-56-aa\WpadDecisionReason = "1" earconslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-ee-d0-44-56-aa\WpadDecisionTime = 2099f13d94abda01 earconslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-ee-d0-44-56-aa\WpadDecision = "0" earconslide.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings earconslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earconslide.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F94CCB16-51A1-4C50-B23E-CC3DDCCD4A65}\7e-ee-d0-44-56-aa earconslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0048000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earconslide.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F94CCB16-51A1-4C50-B23E-CC3DDCCD4A65}\WpadNetworkName = "Network 3" earconslide.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-ee-d0-44-56-aa earconslide.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings earconslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F94CCB16-51A1-4C50-B23E-CC3DDCCD4A65}\WpadDecision = "0" earconslide.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exeearconslide.exeearconslide.exepid process 2748 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe 2856 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe 2416 earconslide.exe 2672 earconslide.exe 2672 earconslide.exe 2672 earconslide.exe 2672 earconslide.exe 2672 earconslide.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exepid process 2856 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exeearconslide.exedescription pid process target process PID 2748 wrote to memory of 2856 2748 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe PID 2748 wrote to memory of 2856 2748 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe PID 2748 wrote to memory of 2856 2748 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe PID 2748 wrote to memory of 2856 2748 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe PID 2416 wrote to memory of 2672 2416 earconslide.exe earconslide.exe PID 2416 wrote to memory of 2672 2416 earconslide.exe earconslide.exe PID 2416 wrote to memory of 2672 2416 earconslide.exe earconslide.exe PID 2416 wrote to memory of 2672 2416 earconslide.exe earconslide.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2856
-
C:\Windows\SysWOW64\earconslide.exe"C:\Windows\SysWOW64\earconslide.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\earconslide.exe"C:\Windows\SysWOW64\earconslide.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2416-15-0x00000000002B0000-0x00000000002CA000-memory.dmpFilesize
104KB
-
memory/2416-27-0x0000000000290000-0x00000000002AA000-memory.dmpFilesize
104KB
-
memory/2416-19-0x00000000002B0000-0x00000000002CA000-memory.dmpFilesize
104KB
-
memory/2416-20-0x0000000000290000-0x00000000002AA000-memory.dmpFilesize
104KB
-
memory/2416-21-0x00000000002D0000-0x00000000002F0000-memory.dmpFilesize
128KB
-
memory/2672-22-0x0000000000770000-0x000000000078A000-memory.dmpFilesize
104KB
-
memory/2672-26-0x0000000000770000-0x000000000078A000-memory.dmpFilesize
104KB
-
memory/2672-32-0x0000000000750000-0x000000000076A000-memory.dmpFilesize
104KB
-
memory/2672-29-0x0000000000790000-0x00000000007B0000-memory.dmpFilesize
128KB
-
memory/2672-28-0x0000000000750000-0x000000000076A000-memory.dmpFilesize
104KB
-
memory/2748-0-0x00000000002B0000-0x00000000002CA000-memory.dmpFilesize
104KB
-
memory/2748-4-0x00000000002B0000-0x00000000002CA000-memory.dmpFilesize
104KB
-
memory/2748-5-0x0000000000290000-0x00000000002AA000-memory.dmpFilesize
104KB
-
memory/2748-6-0x0000000000350000-0x0000000000370000-memory.dmpFilesize
128KB
-
memory/2748-13-0x0000000000290000-0x00000000002AA000-memory.dmpFilesize
104KB
-
memory/2856-12-0x00000000002F0000-0x000000000030A000-memory.dmpFilesize
104KB
-
memory/2856-14-0x0000000000330000-0x0000000000350000-memory.dmpFilesize
128KB
-
memory/2856-7-0x0000000000310000-0x000000000032A000-memory.dmpFilesize
104KB
-
memory/2856-30-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2856-31-0x00000000002F0000-0x000000000030A000-memory.dmpFilesize
104KB
-
memory/2856-11-0x0000000000310000-0x000000000032A000-memory.dmpFilesize
104KB