Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 22:27
Static task
static1
Behavioral task
behavioral1
Sample
6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe
-
Size
120KB
-
MD5
6c757d678105b9c79e56aeae552871b2
-
SHA1
53e9563337201cef300c192de8fc9c20688e6d69
-
SHA256
392b1e9b1d943bf15c0668b0494fdb1a23eb57f44e0afae26ebcf9ed356528e4
-
SHA512
30711d53941c43ab17f51eec1171542013899382b53e4e5c32e81cd46925be35fc4eae58fa1e41ff27db1fe3c6a0289332a58cb6b9738e655ac2cdb0dd4c85c6
-
SSDEEP
1536:hh+VKbz74iVTtbnEQhhSqklN4oyk2tO+ELlDStvvztFTzmcK:hhTHMi/EQORlyk28J2dvZN5K
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
rolecompile.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rolecompile.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 19 IoCs
Processes:
rolecompile.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-4e-66-2e-99-92\WpadDecisionReason = "1" rolecompile.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rolecompile.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2DEC5CDA-76F1-4186-93F3-081B63244F6F} rolecompile.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2DEC5CDA-76F1-4186-93F3-081B63244F6F}\WpadDecisionTime = 0076916860adda01 rolecompile.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2DEC5CDA-76F1-4186-93F3-081B63244F6F}\96-4e-66-2e-99-92 rolecompile.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-4e-66-2e-99-92\WpadDecision = "0" rolecompile.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings rolecompile.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad rolecompile.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-4e-66-2e-99-92 rolecompile.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rolecompile.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rolecompile.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2DEC5CDA-76F1-4186-93F3-081B63244F6F}\WpadDecisionReason = "1" rolecompile.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2DEC5CDA-76F1-4186-93F3-081B63244F6F}\WpadDecision = "0" rolecompile.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2DEC5CDA-76F1-4186-93F3-081B63244F6F}\WpadNetworkName = "Network 3" rolecompile.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-4e-66-2e-99-92\WpadDecisionTime = 0076916860adda01 rolecompile.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings rolecompile.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rolecompile.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" rolecompile.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-4e-66-2e-99-92\WpadDetectedUrl rolecompile.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exerolecompile.exerolecompile.exepid process 2972 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe 2996 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe 2644 rolecompile.exe 2560 rolecompile.exe 2560 rolecompile.exe 2560 rolecompile.exe 2560 rolecompile.exe 2560 rolecompile.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exepid process 2996 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exerolecompile.exedescription pid process target process PID 2972 wrote to memory of 2996 2972 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe PID 2972 wrote to memory of 2996 2972 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe PID 2972 wrote to memory of 2996 2972 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe PID 2972 wrote to memory of 2996 2972 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe 6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe PID 2644 wrote to memory of 2560 2644 rolecompile.exe rolecompile.exe PID 2644 wrote to memory of 2560 2644 rolecompile.exe rolecompile.exe PID 2644 wrote to memory of 2560 2644 rolecompile.exe rolecompile.exe PID 2644 wrote to memory of 2560 2644 rolecompile.exe rolecompile.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2996
-
C:\Windows\SysWOW64\rolecompile.exe"C:\Windows\SysWOW64\rolecompile.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\rolecompile.exe"C:\Windows\SysWOW64\rolecompile.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2560-18-0x0000000000440000-0x0000000000457000-memory.dmpFilesize
92KB
-
memory/2560-27-0x0000000000420000-0x0000000000437000-memory.dmpFilesize
92KB
-
memory/2560-22-0x0000000000420000-0x0000000000437000-memory.dmpFilesize
92KB
-
memory/2560-24-0x0000000000DA0000-0x0000000000DB8000-memory.dmpFilesize
96KB
-
memory/2644-17-0x0000000000380000-0x0000000000398000-memory.dmpFilesize
96KB
-
memory/2644-12-0x00000000002C0000-0x00000000002D7000-memory.dmpFilesize
92KB
-
memory/2644-13-0x00000000002E0000-0x00000000002F7000-memory.dmpFilesize
92KB
-
memory/2644-23-0x00000000002C0000-0x00000000002D7000-memory.dmpFilesize
92KB
-
memory/2972-0-0x0000000000350000-0x0000000000367000-memory.dmpFilesize
92KB
-
memory/2972-4-0x0000000000330000-0x0000000000347000-memory.dmpFilesize
92KB
-
memory/2972-5-0x0000000000370000-0x0000000000388000-memory.dmpFilesize
96KB
-
memory/2996-10-0x00000000003E0000-0x00000000003F7000-memory.dmpFilesize
92KB
-
memory/2996-11-0x0000000000480000-0x0000000000498000-memory.dmpFilesize
96KB
-
memory/2996-6-0x0000000000460000-0x0000000000477000-memory.dmpFilesize
92KB
-
memory/2996-25-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2996-26-0x00000000003E0000-0x00000000003F7000-memory.dmpFilesize
92KB