Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 16:46
Static task
static1
Behavioral task
behavioral1
Sample
6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe
-
Size
128KB
-
MD5
6404079117fdcfa3a34eecb4009b407e
-
SHA1
1a0455583d0dfa71b8cf00a431ec9fb034e31670
-
SHA256
bbd2e2fbf9de689b293485b4cd01e9455201a3974a3082b68862e2e98d76d65c
-
SHA512
52cf0670e2b3106fa6fba0e1a34bc6e9588d2c66ed63a6c85119b8cd5c6709f4feb8d0918d0b953eb1290733a6aadf3adbdb61170c09e83954f052499c4c4709
-
SSDEEP
3072:nPAAAAAAAAAAAAAAAAAA0AAA6XWAAAAAAAAoAAAAAAAAAAAAAAAAAAAAAALo9AAe:dS2eSATfi7I1RVJ
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
dhcpservice.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat dhcpservice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
dhcpservice.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings dhcpservice.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 dhcpservice.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix dhcpservice.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" dhcpservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad dhcpservice.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-0c-b7-89-d4 dhcpservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings dhcpservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{63EFE3F9-1A0E-415E-A843-1AE5D215C574}\WpadDecision = "0" dhcpservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections dhcpservice.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" dhcpservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" dhcpservice.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{63EFE3F9-1A0E-415E-A843-1AE5D215C574} dhcpservice.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{63EFE3F9-1A0E-415E-A843-1AE5D215C574}\be-1c-0c-b7-89-d4 dhcpservice.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-0c-b7-89-d4\WpadDecisionTime = e03fa8709eabda01 dhcpservice.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 dhcpservice.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0027000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 dhcpservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{63EFE3F9-1A0E-415E-A843-1AE5D215C574}\WpadDecisionReason = "1" dhcpservice.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{63EFE3F9-1A0E-415E-A843-1AE5D215C574}\WpadDecisionTime = e03fa8709eabda01 dhcpservice.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{63EFE3F9-1A0E-415E-A843-1AE5D215C574}\WpadNetworkName = "Network 3" dhcpservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-0c-b7-89-d4\WpadDecisionReason = "1" dhcpservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-0c-b7-89-d4\WpadDecision = "0" dhcpservice.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
dhcpservice.exepid process 2720 dhcpservice.exe 2720 dhcpservice.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exepid process 2224 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exedhcpservice.exedescription pid process target process PID 2480 wrote to memory of 2224 2480 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe PID 2480 wrote to memory of 2224 2480 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe PID 2480 wrote to memory of 2224 2480 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe PID 2480 wrote to memory of 2224 2480 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe 6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe PID 1992 wrote to memory of 2720 1992 dhcpservice.exe dhcpservice.exe PID 1992 wrote to memory of 2720 1992 dhcpservice.exe dhcpservice.exe PID 1992 wrote to memory of 2720 1992 dhcpservice.exe dhcpservice.exe PID 1992 wrote to memory of 2720 1992 dhcpservice.exe dhcpservice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6404079117fdcfa3a34eecb4009b407e_JaffaCakes118.exe"2⤵
- Suspicious behavior: RenamesItself
PID:2224
-
C:\Windows\SysWOW64\dhcpservice.exeC:\Windows\SysWOW64\dhcpservice.exe1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\dhcpservice.exe"C:\Windows\SysWOW64\dhcpservice.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1992-19-0x00000000001E0000-0x00000000001EE000-memory.dmpFilesize
56KB
-
memory/1992-28-0x00000000001D0000-0x00000000001DE000-memory.dmpFilesize
56KB
-
memory/1992-20-0x00000000001D0000-0x00000000001DE000-memory.dmpFilesize
56KB
-
memory/1992-21-0x00000000001F0000-0x0000000000200000-memory.dmpFilesize
64KB
-
memory/1992-15-0x00000000001E0000-0x00000000001EE000-memory.dmpFilesize
56KB
-
memory/2224-11-0x00000000001E0000-0x00000000001EE000-memory.dmpFilesize
56KB
-
memory/2224-13-0x0000000000280000-0x0000000000290000-memory.dmpFilesize
64KB
-
memory/2224-12-0x00000000001D0000-0x00000000001DE000-memory.dmpFilesize
56KB
-
memory/2224-7-0x00000000001E0000-0x00000000001EE000-memory.dmpFilesize
56KB
-
memory/2224-29-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2224-30-0x00000000001D0000-0x00000000001DE000-memory.dmpFilesize
56KB
-
memory/2480-14-0x0000000000240000-0x000000000024E000-memory.dmpFilesize
56KB
-
memory/2480-0-0x0000000000250000-0x000000000025E000-memory.dmpFilesize
56KB
-
memory/2480-5-0x0000000000240000-0x000000000024E000-memory.dmpFilesize
56KB
-
memory/2480-6-0x0000000000260000-0x0000000000270000-memory.dmpFilesize
64KB
-
memory/2480-4-0x0000000000250000-0x000000000025E000-memory.dmpFilesize
56KB
-
memory/2720-27-0x0000000000240000-0x000000000024E000-memory.dmpFilesize
56KB
-
memory/2720-31-0x0000000000240000-0x000000000024E000-memory.dmpFilesize
56KB