Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 16:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe
Resource
win7-20240508-en
7 signatures
150 seconds
General
-
Target
6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe
-
Size
128KB
-
MD5
6404079117fdcfa3a34eecb4009b407e
-
SHA1
1a0455583d0dfa71b8cf00a431ec9fb034e31670
-
SHA256
bbd2e2fbf9de689b293485b4cd01e9455201a3974a3082b68862e2e98d76d65c
-
SHA512
52cf0670e2b3106fa6fba0e1a34bc6e9588d2c66ed63a6c85119b8cd5c6709f4feb8d0918d0b953eb1290733a6aadf3adbdb61170c09e83954f052499c4c4709
-
SSDEEP
3072:nPAAAAAAAAAAAAAAAAAA0AAA6XWAAAAAAAAoAAAAAAAAAAAAAAAAAAAAAALo9AAe:dS2eSATfi7I1RVJ
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat dhcpservice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 21 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings dhcpservice.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 dhcpservice.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix dhcpservice.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" dhcpservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad dhcpservice.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-0c-b7-89-d4 dhcpservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings dhcpservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{63EFE3F9-1A0E-415E-A843-1AE5D215C574}\WpadDecision = "0" dhcpservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections dhcpservice.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" dhcpservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" dhcpservice.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{63EFE3F9-1A0E-415E-A843-1AE5D215C574} dhcpservice.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{63EFE3F9-1A0E-415E-A843-1AE5D215C574}\be-1c-0c-b7-89-d4 dhcpservice.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-0c-b7-89-d4\WpadDecisionTime = e03fa8709eabda01 dhcpservice.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 dhcpservice.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0027000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 dhcpservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{63EFE3F9-1A0E-415E-A843-1AE5D215C574}\WpadDecisionReason = "1" dhcpservice.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{63EFE3F9-1A0E-415E-A843-1AE5D215C574}\WpadDecisionTime = e03fa8709eabda01 dhcpservice.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{63EFE3F9-1A0E-415E-A843-1AE5D215C574}\WpadNetworkName = "Network 3" dhcpservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-0c-b7-89-d4\WpadDecisionReason = "1" dhcpservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-0c-b7-89-d4\WpadDecision = "0" dhcpservice.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2720 dhcpservice.exe 2720 dhcpservice.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2224 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2224 2480 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe 28 PID 2480 wrote to memory of 2224 2480 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe 28 PID 2480 wrote to memory of 2224 2480 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe 28 PID 2480 wrote to memory of 2224 2480 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe 28 PID 1992 wrote to memory of 2720 1992 dhcpservice.exe 30 PID 1992 wrote to memory of 2720 1992 dhcpservice.exe 30 PID 1992 wrote to memory of 2720 1992 dhcpservice.exe 30 PID 1992 wrote to memory of 2720 1992 dhcpservice.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe"2⤵
- Suspicious behavior: RenamesItself
PID:2224
-
-
C:\Windows\SysWOW64\dhcpservice.exeC:\Windows\SysWOW64\dhcpservice.exe1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\dhcpservice.exe"C:\Windows\SysWOW64\dhcpservice.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2720
-