Analysis
-
max time kernel
129s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 00:46
Static task
static1
Behavioral task
behavioral1
Sample
656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe
-
Size
275KB
-
MD5
656750f875112414a75fb4bf32a3353a
-
SHA1
1f66bba3d8a9da44b0ebe7a84c7b240b6eba3705
-
SHA256
761107a1e9e685c4bbce78c45111db8c0279bf530b123f5370620bcc6aa0b2bf
-
SHA512
7cde504a285f343972877b3e50cad0fa4b0f558a987288832e88d8f1d08062bc1b379220480f760f8469f6d10423b29f19538fca1bd8acd5bafaa29fb7a9ae90
-
SSDEEP
3072:WyZXE1FYZcYbV/wQvFUO+x33/mKOQ+/pclnNu8qLAZXNOp/PK7nbs5peTE0E925h:W0moc+VvFL+x33zORyI2OlPK7nbgpm9
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat refdbg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings refdbg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 refdbg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" refdbg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\WpadDecision = "0" refdbg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 refdbg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\ea-a9-87-57-0d-80 refdbg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a9-87-57-0d-80\WpadDecisionTime = 40cdb28ae1abda01 refdbg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a9-87-57-0d-80\WpadDecision = "0" refdbg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3} refdbg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\WpadDecisionReason = "1" refdbg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\WpadDecisionTime = 40cdb28ae1abda01 refdbg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\WpadNetworkName = "Network 3" refdbg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a9-87-57-0d-80 refdbg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a9-87-57-0d-80\WpadDecisionReason = "1" refdbg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections refdbg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings refdbg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad refdbg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0058000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 refdbg.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2924 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe 2852 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe 1232 refdbg.exe 2568 refdbg.exe 2568 refdbg.exe 2568 refdbg.exe 2568 refdbg.exe 2568 refdbg.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2852 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2852 2924 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe 28 PID 2924 wrote to memory of 2852 2924 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe 28 PID 2924 wrote to memory of 2852 2924 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe 28 PID 2924 wrote to memory of 2852 2924 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe 28 PID 1232 wrote to memory of 2568 1232 refdbg.exe 30 PID 1232 wrote to memory of 2568 1232 refdbg.exe 30 PID 1232 wrote to memory of 2568 1232 refdbg.exe 30 PID 1232 wrote to memory of 2568 1232 refdbg.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2852
-
-
C:\Windows\SysWOW64\refdbg.exe"C:\Windows\SysWOW64\refdbg.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\refdbg.exe"C:\Windows\SysWOW64\refdbg.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2568
-