Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 19:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe
Resource
win7-20240215-en
9 signatures
150 seconds
General
-
Target
648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe
-
Size
136KB
-
MD5
648fdc19f6c9edca30a8f9a756234699
-
SHA1
321f822bb486dccfad216ff2b2a40e4112637a4f
-
SHA256
52d4dafbcfae960f9c56c22dd3013b33747410cc14d384ae26caaae26f7e74c5
-
SHA512
ae2a2a284424412d9d85d55beddc3d90bf8b193f625accf779e04360f73857d96dcd39d228d9e6a3004da1c52bc0afe3b291976244364f612819132230186c32
-
SSDEEP
3072:Fkh20/12+YvN69kc10oF+RDINn6j9DyIK3cIRV0x2IY:Fkh20/12+Y8Kc13kDYn6jdyIK3PV0J
Malware Config
Signatures
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 148.103.9.108 Destination IP 148.103.9.108 -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat adamavatar.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\PowerCfg 648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\PowerCfg 648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe -
Modifies data under HKEY_USERS 20 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Control Panel\PowerCfg adamavatar.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" adamavatar.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad adamavatar.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0058000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 adamavatar.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\WpadDecisionReason = "1" adamavatar.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a9-87-57-0d-80\WpadDecision = "0" adamavatar.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings adamavatar.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 adamavatar.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\WpadDecision = "0" adamavatar.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a9-87-57-0d-80 adamavatar.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 adamavatar.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3} adamavatar.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\WpadDecisionTime = 105d33ddb8abda01 adamavatar.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\ea-a9-87-57-0d-80 adamavatar.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a9-87-57-0d-80\WpadDecisionReason = "1" adamavatar.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\PowerCfg adamavatar.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections adamavatar.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings adamavatar.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\WpadNetworkName = "Network 3" adamavatar.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a9-87-57-0d-80\WpadDecisionTime = 105d33ddb8abda01 adamavatar.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2916 648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe 2500 648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe 2088 adamavatar.exe 2528 adamavatar.exe 2528 adamavatar.exe 2528 adamavatar.exe 2528 adamavatar.exe 2528 adamavatar.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2500 648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2500 2916 648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe 28 PID 2916 wrote to memory of 2500 2916 648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe 28 PID 2916 wrote to memory of 2500 2916 648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe 28 PID 2916 wrote to memory of 2500 2916 648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe 28 PID 2088 wrote to memory of 2528 2088 adamavatar.exe 30 PID 2088 wrote to memory of 2528 2088 adamavatar.exe 30 PID 2088 wrote to memory of 2528 2088 adamavatar.exe 30 PID 2088 wrote to memory of 2528 2088 adamavatar.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe"1⤵
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\648fdc19f6c9edca30a8f9a756234699_JaffaCakes118.exe"2⤵
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2500
-
-
C:\Windows\SysWOW64\adamavatar.exe"C:\Windows\SysWOW64\adamavatar.exe"1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\adamavatar.exe"C:\Windows\SysWOW64\adamavatar.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2528
-