Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 14:59
Static task
static1
Behavioral task
behavioral1
Sample
6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe
-
Size
290KB
-
MD5
6ee81f19c0b8da85487a32edf30f5bb8
-
SHA1
b9d3243e178801d63948ff19cd8613baa1dfeee0
-
SHA256
55330a70b305c34a9bb3197912c3307f5880cde77cff782d509c05621e52e6ab
-
SHA512
9d7c313536e8809fca41ee52d708118abbf68a20dd616aaf1797e52015c876579aadc224672b98847859e9ff1ea932c43c1d52b9abe1a839b079e2bec0abe8d4
-
SSDEEP
3072:WH0jhuyeZ9/ulQy0tPzsJgSebg5FkmIyDZlGDBb2whiWz0YXdjyBBR5s2Kg0Y+PE:WHpL28QJgSebWTIyDZK2wh0YXd6BIu
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
bearsattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat bearsattrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 19 IoCs
Processes:
bearsattrib.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA1BBD2F-E8B6-4DD1-8D1E-6567BD2EE38B}\WpadDecision = "0" bearsattrib.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA1BBD2F-E8B6-4DD1-8D1E-6567BD2EE38B}\06-06-a1-c9-6d-1e bearsattrib.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA1BBD2F-E8B6-4DD1-8D1E-6567BD2EE38B}\WpadDecisionTime = 40ec8c08ebadda01 bearsattrib.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" bearsattrib.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA1BBD2F-E8B6-4DD1-8D1E-6567BD2EE38B}\WpadNetworkName = "Network 3" bearsattrib.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-06-a1-c9-6d-1e\WpadDecision = "0" bearsattrib.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections bearsattrib.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bearsattrib.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bearsattrib.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bearsattrib.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA1BBD2F-E8B6-4DD1-8D1E-6567BD2EE38B} bearsattrib.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-06-a1-c9-6d-1e bearsattrib.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-06-a1-c9-6d-1e\WpadDecisionTime = 40ec8c08ebadda01 bearsattrib.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-06-a1-c9-6d-1e\WpadDetectedUrl bearsattrib.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings bearsattrib.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad bearsattrib.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA1BBD2F-E8B6-4DD1-8D1E-6567BD2EE38B}\WpadDecisionReason = "1" bearsattrib.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-06-a1-c9-6d-1e\WpadDecisionReason = "1" bearsattrib.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings bearsattrib.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exebearsattrib.exebearsattrib.exepid process 2876 6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe 3016 6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe 2504 bearsattrib.exe 2644 bearsattrib.exe 2644 bearsattrib.exe 2644 bearsattrib.exe 2644 bearsattrib.exe 2644 bearsattrib.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exepid process 3016 6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exebearsattrib.exedescription pid process target process PID 2876 wrote to memory of 3016 2876 6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe 6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe PID 2876 wrote to memory of 3016 2876 6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe 6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe PID 2876 wrote to memory of 3016 2876 6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe 6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe PID 2876 wrote to memory of 3016 2876 6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe 6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe PID 2504 wrote to memory of 2644 2504 bearsattrib.exe bearsattrib.exe PID 2504 wrote to memory of 2644 2504 bearsattrib.exe bearsattrib.exe PID 2504 wrote to memory of 2644 2504 bearsattrib.exe bearsattrib.exe PID 2504 wrote to memory of 2644 2504 bearsattrib.exe bearsattrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6ee81f19c0b8da85487a32edf30f5bb8_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:3016
-
C:\Windows\SysWOW64\bearsattrib.exe"C:\Windows\SysWOW64\bearsattrib.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\bearsattrib.exe"C:\Windows\SysWOW64\bearsattrib.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2504-18-0x0000000000290000-0x00000000002A7000-memory.dmpFilesize
92KB
-
memory/2504-19-0x0000000000270000-0x0000000000287000-memory.dmpFilesize
92KB
-
memory/2504-20-0x00000000003B0000-0x00000000003C0000-memory.dmpFilesize
64KB
-
memory/2504-14-0x0000000000290000-0x00000000002A7000-memory.dmpFilesize
92KB
-
memory/2644-25-0x00000000005E0000-0x00000000005F7000-memory.dmpFilesize
92KB
-
memory/2644-21-0x00000000005E0000-0x00000000005F7000-memory.dmpFilesize
92KB
-
memory/2876-0-0x0000000000450000-0x0000000000467000-memory.dmpFilesize
92KB
-
memory/2876-5-0x00000000003E0000-0x00000000003F7000-memory.dmpFilesize
92KB
-
memory/2876-6-0x0000000000470000-0x0000000000480000-memory.dmpFilesize
64KB
-
memory/2876-4-0x0000000000450000-0x0000000000467000-memory.dmpFilesize
92KB
-
memory/3016-13-0x00000000002B0000-0x00000000002C0000-memory.dmpFilesize
64KB
-
memory/3016-12-0x0000000000270000-0x0000000000287000-memory.dmpFilesize
92KB
-
memory/3016-7-0x0000000000290000-0x00000000002A7000-memory.dmpFilesize
92KB
-
memory/3016-11-0x0000000000290000-0x00000000002A7000-memory.dmpFilesize
92KB
-
memory/3016-26-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/3016-27-0x0000000000270000-0x0000000000287000-memory.dmpFilesize
92KB