Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 17:59
Static task
static1
Behavioral task
behavioral1
Sample
643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe
-
Size
113KB
-
MD5
643a1f9e7b6699a63dd5b9719078c63c
-
SHA1
7074e1630d36c4586e5e18919968e2e1589f39e4
-
SHA256
2e46d920c3a093587ec5544a8032856b31189e84967e92a988be77b3c5e10480
-
SHA512
40ea4469321a5ae0ad95ebf10fa0e4242e1bc59e2c6de9cf55ce2aac7ff1adba2d8687404e5343c025eaf96b288c88c97927cb28fc2665754d6f1ce247686a72
-
SSDEEP
1536:fosdaSM3ZyoLaTYoMQv7A3UQfaZbIcJm4TpXBQaweLFCexyy/SDSPXIze1XrfBNK:fosdUuIn4luaweLYuyvOPXIzibK
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
propiso.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat propiso.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
propiso.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" propiso.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings propiso.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad propiso.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0850A76B-D348-49B6-BF92-C182D8B9A5FB}\WpadDecision = "0" propiso.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0850A76B-D348-49B6-BF92-C182D8B9A5FB}\7a-fb-28-8e-e0-81 propiso.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-fb-28-8e-e0-81\WpadDecisionTime = 8071cd9ca8abda01 propiso.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings propiso.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 propiso.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0850A76B-D348-49B6-BF92-C182D8B9A5FB} propiso.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0850A76B-D348-49B6-BF92-C182D8B9A5FB}\WpadDecisionTime = 8071cd9ca8abda01 propiso.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-fb-28-8e-e0-81 propiso.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections propiso.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" propiso.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 propiso.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0850A76B-D348-49B6-BF92-C182D8B9A5FB}\WpadDecisionReason = "1" propiso.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0850A76B-D348-49B6-BF92-C182D8B9A5FB}\WpadNetworkName = "Network 3" propiso.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-fb-28-8e-e0-81\WpadDecision = "0" propiso.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix propiso.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" propiso.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0131000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 propiso.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-fb-28-8e-e0-81\WpadDecisionReason = "1" propiso.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
propiso.exepid process 2644 propiso.exe 2644 propiso.exe 2644 propiso.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exepid process 768 643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exepropiso.exedescription pid process target process PID 2792 wrote to memory of 768 2792 643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe 643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe PID 2792 wrote to memory of 768 2792 643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe 643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe PID 2792 wrote to memory of 768 2792 643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe 643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe PID 2792 wrote to memory of 768 2792 643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe 643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe PID 2984 wrote to memory of 2644 2984 propiso.exe propiso.exe PID 2984 wrote to memory of 2644 2984 propiso.exe propiso.exe PID 2984 wrote to memory of 2644 2984 propiso.exe propiso.exe PID 2984 wrote to memory of 2644 2984 propiso.exe propiso.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\643a1f9e7b6699a63dd5b9719078c63c_JaffaCakes118.exe"2⤵
- Suspicious behavior: RenamesItself
PID:768
-
C:\Windows\SysWOW64\propiso.exeC:\Windows\SysWOW64\propiso.exe1⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\propiso.exe"C:\Windows\SysWOW64\propiso.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-13-0x0000000000290000-0x00000000002A0000-memory.dmpFilesize
64KB
-
memory/768-28-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/768-29-0x0000000000270000-0x000000000027E000-memory.dmpFilesize
56KB
-
memory/768-12-0x0000000000270000-0x000000000027E000-memory.dmpFilesize
56KB
-
memory/768-11-0x0000000000280000-0x000000000028E000-memory.dmpFilesize
56KB
-
memory/768-8-0x0000000000280000-0x000000000028E000-memory.dmpFilesize
56KB
-
memory/2792-14-0x00000000003B0000-0x00000000003BE000-memory.dmpFilesize
56KB
-
memory/2792-6-0x00000000003D0000-0x00000000003E0000-memory.dmpFilesize
64KB
-
memory/2792-4-0x00000000003C0000-0x00000000003CE000-memory.dmpFilesize
56KB
-
memory/2792-0-0x00000000003C0000-0x00000000003CE000-memory.dmpFilesize
56KB
-
memory/2792-5-0x00000000003B0000-0x00000000003BE000-memory.dmpFilesize
56KB
-
memory/2984-19-0x00000000003D0000-0x00000000003DE000-memory.dmpFilesize
56KB
-
memory/2984-15-0x00000000003D0000-0x00000000003DE000-memory.dmpFilesize
56KB
-
memory/2984-21-0x00000000003E0000-0x00000000003F0000-memory.dmpFilesize
64KB
-
memory/2984-20-0x00000000003C0000-0x00000000003CE000-memory.dmpFilesize
56KB
-
memory/2984-27-0x00000000003C0000-0x00000000003CE000-memory.dmpFilesize
56KB