Analysis
-
max time kernel
132s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 19:00
Static task
static1
Behavioral task
behavioral1
Sample
6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe
-
Size
576KB
-
MD5
6bf45b695c31bf5dbc059dad692e6ad1
-
SHA1
d751433c4528b4999a0df31c6d9e4c10602497cd
-
SHA256
59b2fb7570bee0d8c7602b8c7b489fc6a6b6dff2ab6671d9b1d2ef339b7b020a
-
SHA512
e22ea4ca40ae4053819a74a5f690a4ac63dc0b5e6707de390b974e16f17d99fe650770153543e1b753865437a1707ec8085f9f00b9d5af150d4fe46b77507da0
-
SSDEEP
3072:dMEPRirOdRTsSkHGXyMOrYOXuJwn44oQ4SYGSicM:dHQOdRQSkHGBAYwdnYGk
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
systemshlp.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat systemshlp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 18 IoCs
Processes:
systemshlp.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 systemshlp.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 systemshlp.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\WpadDecisionReason = "1" systemshlp.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\WpadDecision = "0" systemshlp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-16-0e-00-7c-ec systemshlp.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-16-0e-00-7c-ec\WpadDecisionTime = 300ca88a43adda01 systemshlp.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-16-0e-00-7c-ec\WpadDecision = "0" systemshlp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections systemshlp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings systemshlp.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" systemshlp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad systemshlp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\WpadNetworkName = "Network 3" systemshlp.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-16-0e-00-7c-ec\WpadDecisionReason = "1" systemshlp.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings systemshlp.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 systemshlp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4} systemshlp.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\WpadDecisionTime = 300ca88a43adda01 systemshlp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\72-16-0e-00-7c-ec systemshlp.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exesystemshlp.exesystemshlp.exepid process 2076 6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe 2052 6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe 2456 systemshlp.exe 2860 systemshlp.exe 2860 systemshlp.exe 2860 systemshlp.exe 2860 systemshlp.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exepid process 2052 6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exesystemshlp.exedescription pid process target process PID 2076 wrote to memory of 2052 2076 6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe 6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe PID 2076 wrote to memory of 2052 2076 6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe 6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe PID 2076 wrote to memory of 2052 2076 6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe 6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe PID 2076 wrote to memory of 2052 2076 6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe 6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe PID 2456 wrote to memory of 2860 2456 systemshlp.exe systemshlp.exe PID 2456 wrote to memory of 2860 2456 systemshlp.exe systemshlp.exe PID 2456 wrote to memory of 2860 2456 systemshlp.exe systemshlp.exe PID 2456 wrote to memory of 2860 2456 systemshlp.exe systemshlp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6bf45b695c31bf5dbc059dad692e6ad1_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2052
-
C:\Windows\SysWOW64\systemshlp.exe"C:\Windows\SysWOW64\systemshlp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\systemshlp.exe"C:\Windows\SysWOW64\systemshlp.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2052-27-0x00000000002D0000-0x00000000002E7000-memory.dmpFilesize
92KB
-
memory/2052-12-0x00000000002D0000-0x00000000002E7000-memory.dmpFilesize
92KB
-
memory/2052-13-0x0000000000310000-0x0000000000320000-memory.dmpFilesize
64KB
-
memory/2052-7-0x00000000002F0000-0x0000000000307000-memory.dmpFilesize
92KB
-
memory/2052-11-0x00000000002F0000-0x0000000000307000-memory.dmpFilesize
92KB
-
memory/2052-26-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/2076-5-0x0000000000240000-0x0000000000257000-memory.dmpFilesize
92KB
-
memory/2076-4-0x0000000000260000-0x0000000000277000-memory.dmpFilesize
92KB
-
memory/2076-0-0x0000000000260000-0x0000000000277000-memory.dmpFilesize
92KB
-
memory/2076-6-0x0000000000290000-0x00000000002A0000-memory.dmpFilesize
64KB
-
memory/2456-20-0x00000000004A0000-0x00000000004B0000-memory.dmpFilesize
64KB
-
memory/2456-18-0x00000000003E0000-0x00000000003F7000-memory.dmpFilesize
92KB
-
memory/2456-14-0x00000000003E0000-0x00000000003F7000-memory.dmpFilesize
92KB
-
memory/2456-19-0x0000000000250000-0x0000000000267000-memory.dmpFilesize
92KB
-
memory/2860-21-0x00000000008B0000-0x00000000008C7000-memory.dmpFilesize
92KB
-
memory/2860-25-0x00000000008B0000-0x00000000008C7000-memory.dmpFilesize
92KB