Analysis
-
max time kernel
128s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 17:04
Static task
static1
Behavioral task
behavioral1
Sample
6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe
-
Size
118KB
-
MD5
6f37e56c2838e1d187d6c03496c482a6
-
SHA1
2ac7c565a2f714754c0d59ae5e343df888008a8c
-
SHA256
d04dcafd5b59d82adb14fe35c5ec55ac70bbee08b6d39913f7e23226190adc74
-
SHA512
23c3bbc56e1c1760757e3637af23631ac08ca55bdb4458a357f61352d9782ef8f02376eb75cd41c6802d775a98fd858a17b896fd92839383de7df96f868cd098
-
SSDEEP
1536:XlEnJGqvDsdU/szenCTO4Tm7XUXRNirEkthkZivdxP+HrwIWjWQgdSU6iUIIIBlp:oJGHdFzAFQR4oZ8H6wI37xr
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
sysmgmt.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat sysmgmt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 25 IoCs
Processes:
sysmgmt.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" sysmgmt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1667C4C5-2195-4321-B2B1-D0DFAF127C5B} sysmgmt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1667C4C5-2195-4321-B2B1-D0DFAF127C5B}\WpadDecisionTime = a050b08cfcadda01 sysmgmt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00fb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 sysmgmt.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix sysmgmt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" sysmgmt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad sysmgmt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1667C4C5-2195-4321-B2B1-D0DFAF127C5B}\WpadDecision = "0" sysmgmt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-64-5f-e0-ef-60 sysmgmt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00fb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 sysmgmt.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1667C4C5-2195-4321-B2B1-D0DFAF127C5B}\WpadNetworkName = "Network 3" sysmgmt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-64-5f-e0-ef-60\WpadDecision = "0" sysmgmt.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" sysmgmt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings sysmgmt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1667C4C5-2195-4321-B2B1-D0DFAF127C5B}\4e-64-5f-e0-ef-60 sysmgmt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1667C4C5-2195-4321-B2B1-D0DFAF127C5B}\WpadDecisionTime = 201f01cffcadda01 sysmgmt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-64-5f-e0-ef-60\WpadDecisionTime = 201f01cffcadda01 sysmgmt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 sysmgmt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 sysmgmt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings sysmgmt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-64-5f-e0-ef-60\WpadDecisionTime = a050b08cfcadda01 sysmgmt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections sysmgmt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1667C4C5-2195-4321-B2B1-D0DFAF127C5B}\WpadDecisionReason = "1" sysmgmt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-64-5f-e0-ef-60\WpadDecisionReason = "1" sysmgmt.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-64-5f-e0-ef-60\WpadDetectedUrl sysmgmt.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
sysmgmt.exepid process 2780 sysmgmt.exe 2780 sysmgmt.exe 2780 sysmgmt.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exepid process 2228 6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exesysmgmt.exedescription pid process target process PID 1948 wrote to memory of 2228 1948 6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe 6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe PID 1948 wrote to memory of 2228 1948 6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe 6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe PID 1948 wrote to memory of 2228 1948 6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe 6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe PID 1948 wrote to memory of 2228 1948 6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe 6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe PID 2580 wrote to memory of 2780 2580 sysmgmt.exe sysmgmt.exe PID 2580 wrote to memory of 2780 2580 sysmgmt.exe sysmgmt.exe PID 2580 wrote to memory of 2780 2580 sysmgmt.exe sysmgmt.exe PID 2580 wrote to memory of 2780 2580 sysmgmt.exe sysmgmt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f37e56c2838e1d187d6c03496c482a6_JaffaCakes118.exe"2⤵
- Suspicious behavior: RenamesItself
PID:2228
-
C:\Windows\SysWOW64\sysmgmt.exeC:\Windows\SysWOW64\sysmgmt.exe1⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\sysmgmt.exe"C:\Windows\SysWOW64\sysmgmt.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1948-6-0x0000000000330000-0x0000000000340000-memory.dmpFilesize
64KB
-
memory/1948-4-0x0000000000320000-0x000000000032E000-memory.dmpFilesize
56KB
-
memory/1948-0-0x0000000000320000-0x000000000032E000-memory.dmpFilesize
56KB
-
memory/1948-14-0x0000000000270000-0x000000000027E000-memory.dmpFilesize
56KB
-
memory/1948-5-0x0000000000270000-0x000000000027E000-memory.dmpFilesize
56KB
-
memory/2228-31-0x0000000000290000-0x000000000029E000-memory.dmpFilesize
56KB
-
memory/2228-11-0x00000000002A0000-0x00000000002AE000-memory.dmpFilesize
56KB
-
memory/2228-7-0x00000000002A0000-0x00000000002AE000-memory.dmpFilesize
56KB
-
memory/2228-13-0x00000000002B0000-0x00000000002C0000-memory.dmpFilesize
64KB
-
memory/2228-12-0x0000000000290000-0x000000000029E000-memory.dmpFilesize
56KB
-
memory/2228-30-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2580-19-0x00000000002B0000-0x00000000002BE000-memory.dmpFilesize
56KB
-
memory/2580-20-0x0000000000290000-0x000000000029E000-memory.dmpFilesize
56KB
-
memory/2580-21-0x0000000000420000-0x0000000000430000-memory.dmpFilesize
64KB
-
memory/2580-15-0x00000000002B0000-0x00000000002BE000-memory.dmpFilesize
56KB
-
memory/2580-29-0x0000000000290000-0x000000000029E000-memory.dmpFilesize
56KB
-
memory/2780-26-0x00000000002B0000-0x00000000002BE000-memory.dmpFilesize
56KB
-
memory/2780-22-0x00000000002B0000-0x00000000002BE000-memory.dmpFilesize
56KB
-
memory/2780-28-0x00000000002C0000-0x00000000002D0000-memory.dmpFilesize
64KB
-
memory/2780-27-0x0000000000270000-0x000000000027E000-memory.dmpFilesize
56KB
-
memory/2780-32-0x0000000000270000-0x000000000027E000-memory.dmpFilesize
56KB