Analysis
-
max time kernel
131s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 03:09
Static task
static1
Behavioral task
behavioral1
Sample
6d25483cd59582da7258e584be660fde_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
-
Target
6d25483cd59582da7258e584be660fde_JaffaCakes118.exe
-
Size
144KB
-
MD5
6d25483cd59582da7258e584be660fde
-
SHA1
f322cf004aa269ce6dedad5ada81bcfdae86b687
-
SHA256
31f3340b9cb9d2f1a829c905da3f5adb78c83f2a082e4e7f6430f9cb9039e689
-
SHA512
bf185baf958285c231f7033407df7368ccabe41e2cbaecfc50c2227c2658fcd822ebca828a1c7652c1c1d3cd487226f43e00dae42b9cca59a9de5088812b8de7
-
SSDEEP
3072:ox9PrkoQSsdBb74jipqV7SDRRbQ9X1aOq5hBYtHyk:oXQoHMnAVuDRRbAjyk
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
cvtproc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat cvtproc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
cvtproc.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0074000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cvtproc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{65F9653A-D31C-471E-B15B-0F7F0C085CFC}\WpadNetworkName = "Network 3" cvtproc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-bf-a6-c4-70-74\WpadDecision = "0" cvtproc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings cvtproc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cvtproc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cvtproc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cvtproc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad cvtproc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{65F9653A-D31C-471E-B15B-0F7F0C085CFC}\WpadDecision = "0" cvtproc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-bf-a6-c4-70-74 cvtproc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-bf-a6-c4-70-74\WpadDecisionTime = 806d0ce087adda01 cvtproc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections cvtproc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{65F9653A-D31C-471E-B15B-0F7F0C085CFC}\WpadDecisionReason = "1" cvtproc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-bf-a6-c4-70-74\WpadDecisionReason = "1" cvtproc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{65F9653A-D31C-471E-B15B-0F7F0C085CFC} cvtproc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cvtproc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" cvtproc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cvtproc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{65F9653A-D31C-471E-B15B-0F7F0C085CFC}\WpadDecisionTime = 806d0ce087adda01 cvtproc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{65F9653A-D31C-471E-B15B-0F7F0C085CFC}\02-bf-a6-c4-70-74 cvtproc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings cvtproc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
cvtproc.exepid process 2640 cvtproc.exe 2640 cvtproc.exe 2640 cvtproc.exe 2640 cvtproc.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6d25483cd59582da7258e584be660fde_JaffaCakes118.exepid process 2356 6d25483cd59582da7258e584be660fde_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
6d25483cd59582da7258e584be660fde_JaffaCakes118.exe6d25483cd59582da7258e584be660fde_JaffaCakes118.execvtproc.execvtproc.exepid process 1284 6d25483cd59582da7258e584be660fde_JaffaCakes118.exe 2356 6d25483cd59582da7258e584be660fde_JaffaCakes118.exe 2624 cvtproc.exe 2640 cvtproc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6d25483cd59582da7258e584be660fde_JaffaCakes118.execvtproc.exedescription pid process target process PID 1284 wrote to memory of 2356 1284 6d25483cd59582da7258e584be660fde_JaffaCakes118.exe 6d25483cd59582da7258e584be660fde_JaffaCakes118.exe PID 1284 wrote to memory of 2356 1284 6d25483cd59582da7258e584be660fde_JaffaCakes118.exe 6d25483cd59582da7258e584be660fde_JaffaCakes118.exe PID 1284 wrote to memory of 2356 1284 6d25483cd59582da7258e584be660fde_JaffaCakes118.exe 6d25483cd59582da7258e584be660fde_JaffaCakes118.exe PID 1284 wrote to memory of 2356 1284 6d25483cd59582da7258e584be660fde_JaffaCakes118.exe 6d25483cd59582da7258e584be660fde_JaffaCakes118.exe PID 2624 wrote to memory of 2640 2624 cvtproc.exe cvtproc.exe PID 2624 wrote to memory of 2640 2624 cvtproc.exe cvtproc.exe PID 2624 wrote to memory of 2640 2624 cvtproc.exe cvtproc.exe PID 2624 wrote to memory of 2640 2624 cvtproc.exe cvtproc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d25483cd59582da7258e584be660fde_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6d25483cd59582da7258e584be660fde_JaffaCakes118.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\6d25483cd59582da7258e584be660fde_JaffaCakes118.exe--15b300f92⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:2356
-
C:\Windows\SysWOW64\cvtproc.exe"C:\Windows\SysWOW64\cvtproc.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cvtproc.exe--c700c9cd2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1284-0-0x00000000001B0000-0x00000000001C0000-memory.dmpFilesize
64KB
-
memory/1284-2-0x00000000001B0000-0x00000000001C0000-memory.dmpFilesize
64KB
-
memory/1284-3-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2356-7-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2624-4-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2640-8-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2640-9-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2640-10-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB