Analysis
-
max time kernel
129s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 00:46
Static task
static1
Behavioral task
behavioral1
Sample
656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe
-
Size
275KB
-
MD5
656750f875112414a75fb4bf32a3353a
-
SHA1
1f66bba3d8a9da44b0ebe7a84c7b240b6eba3705
-
SHA256
761107a1e9e685c4bbce78c45111db8c0279bf530b123f5370620bcc6aa0b2bf
-
SHA512
7cde504a285f343972877b3e50cad0fa4b0f558a987288832e88d8f1d08062bc1b379220480f760f8469f6d10423b29f19538fca1bd8acd5bafaa29fb7a9ae90
-
SSDEEP
3072:WyZXE1FYZcYbV/wQvFUO+x33/mKOQ+/pclnNu8qLAZXNOp/PK7nbs5peTE0E925h:W0moc+VvFL+x33zORyI2OlPK7nbgpm9
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
refdbg.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat refdbg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 18 IoCs
Processes:
refdbg.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings refdbg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 refdbg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" refdbg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\WpadDecision = "0" refdbg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 refdbg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\ea-a9-87-57-0d-80 refdbg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a9-87-57-0d-80\WpadDecisionTime = 40cdb28ae1abda01 refdbg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a9-87-57-0d-80\WpadDecision = "0" refdbg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3} refdbg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\WpadDecisionReason = "1" refdbg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\WpadDecisionTime = 40cdb28ae1abda01 refdbg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE17A2EB-9739-420C-8338-6D8E3757EBA3}\WpadNetworkName = "Network 3" refdbg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a9-87-57-0d-80 refdbg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a9-87-57-0d-80\WpadDecisionReason = "1" refdbg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections refdbg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings refdbg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad refdbg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0058000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 refdbg.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe656750f875112414a75fb4bf32a3353a_JaffaCakes118.exerefdbg.exerefdbg.exepid process 2924 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe 2852 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe 1232 refdbg.exe 2568 refdbg.exe 2568 refdbg.exe 2568 refdbg.exe 2568 refdbg.exe 2568 refdbg.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
656750f875112414a75fb4bf32a3353a_JaffaCakes118.exepid process 2852 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
656750f875112414a75fb4bf32a3353a_JaffaCakes118.exerefdbg.exedescription pid process target process PID 2924 wrote to memory of 2852 2924 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe PID 2924 wrote to memory of 2852 2924 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe PID 2924 wrote to memory of 2852 2924 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe PID 2924 wrote to memory of 2852 2924 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe 656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe PID 1232 wrote to memory of 2568 1232 refdbg.exe refdbg.exe PID 1232 wrote to memory of 2568 1232 refdbg.exe refdbg.exe PID 1232 wrote to memory of 2568 1232 refdbg.exe refdbg.exe PID 1232 wrote to memory of 2568 1232 refdbg.exe refdbg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\656750f875112414a75fb4bf32a3353a_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\refdbg.exe"C:\Windows\SysWOW64\refdbg.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\refdbg.exe"C:\Windows\SysWOW64\refdbg.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1232-15-0x0000000000160000-0x0000000000177000-memory.dmpFilesize
92KB
-
memory/1232-28-0x0000000000120000-0x0000000000137000-memory.dmpFilesize
92KB
-
memory/1232-20-0x0000000000140000-0x0000000000150000-memory.dmpFilesize
64KB
-
memory/1232-19-0x0000000000160000-0x0000000000177000-memory.dmpFilesize
92KB
-
memory/2568-27-0x0000000000100000-0x0000000000110000-memory.dmpFilesize
64KB
-
memory/2568-31-0x0000000000170000-0x0000000000187000-memory.dmpFilesize
92KB
-
memory/2568-21-0x0000000000170000-0x0000000000187000-memory.dmpFilesize
92KB
-
memory/2568-22-0x0000000000190000-0x00000000001A7000-memory.dmpFilesize
92KB
-
memory/2568-26-0x0000000000190000-0x00000000001A7000-memory.dmpFilesize
92KB
-
memory/2852-29-0x0000000000830000-0x0000000000879000-memory.dmpFilesize
292KB
-
memory/2852-8-0x0000000000140000-0x0000000000157000-memory.dmpFilesize
92KB
-
memory/2852-13-0x0000000000160000-0x0000000000170000-memory.dmpFilesize
64KB
-
memory/2852-12-0x0000000000140000-0x0000000000157000-memory.dmpFilesize
92KB
-
memory/2852-7-0x0000000000120000-0x0000000000137000-memory.dmpFilesize
92KB
-
memory/2852-30-0x0000000000120000-0x0000000000137000-memory.dmpFilesize
92KB
-
memory/2924-14-0x00000000000B0000-0x00000000000C7000-memory.dmpFilesize
92KB
-
memory/2924-6-0x0000000000130000-0x0000000000140000-memory.dmpFilesize
64KB
-
memory/2924-0-0x00000000000B0000-0x00000000000C7000-memory.dmpFilesize
92KB
-
memory/2924-5-0x0000000000110000-0x0000000000127000-memory.dmpFilesize
92KB
-
memory/2924-1-0x0000000000110000-0x0000000000127000-memory.dmpFilesize
92KB