Analysis
-
max time kernel
131s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 08:21
Static task
static1
Behavioral task
behavioral1
Sample
6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe
-
Size
148KB
-
MD5
6a5361ff62a6729d5a09dc414c505197
-
SHA1
be4452e4f29851235f2edc5acf6cd58420ad26a9
-
SHA256
32f425cfbcc7ca76057c6ccc0ea5e0f27a59f7d276213036e72f8b614b360027
-
SHA512
4d28d5c59a592bc020520cb82c7b297d67928f8445994d036be78f3e044e591c76e91820d47fa07136f9982ef79202f0f065c1c6c9079438738cd0575f57c27f
-
SSDEEP
3072:4zbYMMZQD4tI5SBUq+0lQMhp6O72Xo2EEBWU:4zcWDzSBUSD3R2Xo2Z
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
rippledetect.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rippledetect.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 18 IoCs
Processes:
rippledetect.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" rippledetect.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadDecisionReason = "1" rippledetect.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadDecisionTime = 90901835eaacda01 rippledetect.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadNetworkName = "Network 3" rippledetect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rippledetect.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rippledetect.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadDecision = "0" rippledetect.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\52-7f-59-f5-bc-6f rippledetect.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f\WpadDecisionReason = "1" rippledetect.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f\WpadDecision = "0" rippledetect.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings rippledetect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings rippledetect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad rippledetect.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6} rippledetect.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f rippledetect.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rippledetect.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f\WpadDecisionTime = 90901835eaacda01 rippledetect.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rippledetect.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exerippledetect.exerippledetect.exepid process 2696 6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe 972 6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe 2552 rippledetect.exe 2620 rippledetect.exe 2620 rippledetect.exe 2620 rippledetect.exe 2620 rippledetect.exe 2620 rippledetect.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exepid process 972 6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exerippledetect.exedescription pid process target process PID 2696 wrote to memory of 972 2696 6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe 6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe PID 2696 wrote to memory of 972 2696 6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe 6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe PID 2696 wrote to memory of 972 2696 6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe 6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe PID 2696 wrote to memory of 972 2696 6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe 6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe PID 2552 wrote to memory of 2620 2552 rippledetect.exe rippledetect.exe PID 2552 wrote to memory of 2620 2552 rippledetect.exe rippledetect.exe PID 2552 wrote to memory of 2620 2552 rippledetect.exe rippledetect.exe PID 2552 wrote to memory of 2620 2552 rippledetect.exe rippledetect.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6a5361ff62a6729d5a09dc414c505197_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\rippledetect.exe"C:\Windows\SysWOW64\rippledetect.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rippledetect.exe"C:\Windows\SysWOW64\rippledetect.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/972-13-0x0000000000290000-0x00000000002B0000-memory.dmpFilesize
128KB
-
memory/972-12-0x0000000000090000-0x00000000000AA000-memory.dmpFilesize
104KB
-
memory/972-29-0x0000000000090000-0x00000000000AA000-memory.dmpFilesize
104KB
-
memory/972-28-0x00000000009E0000-0x0000000000A07000-memory.dmpFilesize
156KB
-
memory/972-9-0x0000000000160000-0x000000000017A000-memory.dmpFilesize
104KB
-
memory/972-5-0x0000000000160000-0x000000000017A000-memory.dmpFilesize
104KB
-
memory/2552-20-0x0000000000720000-0x0000000000740000-memory.dmpFilesize
128KB
-
memory/2552-19-0x00000000004B0000-0x00000000004CA000-memory.dmpFilesize
104KB
-
memory/2552-14-0x0000000000700000-0x000000000071A000-memory.dmpFilesize
104KB
-
memory/2552-18-0x0000000000700000-0x000000000071A000-memory.dmpFilesize
104KB
-
memory/2620-26-0x0000000000190000-0x00000000001AA000-memory.dmpFilesize
104KB
-
memory/2620-27-0x00000000001D0000-0x00000000001F0000-memory.dmpFilesize
128KB
-
memory/2620-25-0x00000000001B0000-0x00000000001CA000-memory.dmpFilesize
104KB
-
memory/2620-21-0x00000000001B0000-0x00000000001CA000-memory.dmpFilesize
104KB
-
memory/2620-30-0x0000000000190000-0x00000000001AA000-memory.dmpFilesize
104KB
-
memory/2696-0-0x00000000000B0000-0x00000000000CA000-memory.dmpFilesize
104KB
-
memory/2696-4-0x00000000000B0000-0x00000000000CA000-memory.dmpFilesize
104KB
-
memory/2696-10-0x0000000000090000-0x00000000000AA000-memory.dmpFilesize
104KB
-
memory/2696-11-0x0000000000420000-0x0000000000440000-memory.dmpFilesize
128KB