Analysis
-
max time kernel
131s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 15:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe
Resource
win7-20231129-en
7 signatures
150 seconds
General
-
Target
63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe
-
Size
172KB
-
MD5
63cca393ab309282e416f7a1dcb97dd6
-
SHA1
adf92dfee2d96be5186c5e3c4f449a00970a8998
-
SHA256
0191b05e5ce7e3b5fe92a3326ca74493be9fd9d8e31bdaefa68cbc5c9b6f62e7
-
SHA512
9dae69df205094ef5c11b560db204385db139d4b880b4ef28872bcf7b8248b6bd8e1af62ef62092a9986d9a67132e8b9c2ddc9b8aafe146173ea6a1e51202497
-
SSDEEP
3072:dwa+jvXl2YCdruDD9jiWC4dzopFFICWY86bIWLu4Nrme/1Z7:jYl7WrOiWa1
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat earconslide.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad earconslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F94CCB16-51A1-4C50-B23E-CC3DDCCD4A65}\WpadDecisionReason = "1" earconslide.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections earconslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" earconslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earconslide.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F94CCB16-51A1-4C50-B23E-CC3DDCCD4A65} earconslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F94CCB16-51A1-4C50-B23E-CC3DDCCD4A65}\WpadDecisionTime = 2099f13d94abda01 earconslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-ee-d0-44-56-aa\WpadDecisionReason = "1" earconslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-ee-d0-44-56-aa\WpadDecisionTime = 2099f13d94abda01 earconslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-ee-d0-44-56-aa\WpadDecision = "0" earconslide.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings earconslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earconslide.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F94CCB16-51A1-4C50-B23E-CC3DDCCD4A65}\7e-ee-d0-44-56-aa earconslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0048000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earconslide.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F94CCB16-51A1-4C50-B23E-CC3DDCCD4A65}\WpadNetworkName = "Network 3" earconslide.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-ee-d0-44-56-aa earconslide.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings earconslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F94CCB16-51A1-4C50-B23E-CC3DDCCD4A65}\WpadDecision = "0" earconslide.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2748 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe 2856 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe 2416 earconslide.exe 2672 earconslide.exe 2672 earconslide.exe 2672 earconslide.exe 2672 earconslide.exe 2672 earconslide.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2856 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2856 2748 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe 28 PID 2748 wrote to memory of 2856 2748 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe 28 PID 2748 wrote to memory of 2856 2748 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe 28 PID 2748 wrote to memory of 2856 2748 63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe 28 PID 2416 wrote to memory of 2672 2416 earconslide.exe 30 PID 2416 wrote to memory of 2672 2416 earconslide.exe 30 PID 2416 wrote to memory of 2672 2416 earconslide.exe 30 PID 2416 wrote to memory of 2672 2416 earconslide.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63cca393ab309282e416f7a1dcb97dd6_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2856
-
-
C:\Windows\SysWOW64\earconslide.exe"C:\Windows\SysWOW64\earconslide.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\earconslide.exe"C:\Windows\SysWOW64\earconslide.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2672
-