Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 03:32
Static task
static1
Behavioral task
behavioral1
Sample
70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe
-
Size
672KB
-
MD5
70b98c805dd899ab495c8fc05ed764c5
-
SHA1
d31ac8865116f613474c9c3e94ce2194ba59def3
-
SHA256
1765e8e86cbf4032c41d7a678289637b8ee5d79c4d0a8c42b9c25477af24daec
-
SHA512
bf615f3954371b13ab0e4a561db5e5becb8f8f19c27acc838028a555949d427b76f6fc091dd54ef364027d66e41a0bd7791c9f24a96369f29787ae8349399a0d
-
SSDEEP
6144:udSw4vVxg2WUxHQGDI6NRw4/zJzgwmQ6J:udSJNxg27ZFI6NRNJzBm5J
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
wdiwfp.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat wdiwfp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 18 IoCs
Processes:
wdiwfp.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings wdiwfp.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{81BC786A-E37C-4B2C-8FE3-F4D0D7469805}\WpadDecision = "0" wdiwfp.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{81BC786A-E37C-4B2C-8FE3-F4D0D7469805}\b6-6c-6f-ad-72-fc wdiwfp.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{81BC786A-E37C-4B2C-8FE3-F4D0D7469805}\WpadNetworkName = "Network 3" wdiwfp.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-6c-6f-ad-72-fc\WpadDecision = "0" wdiwfp.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 wdiwfp.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" wdiwfp.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0037000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 wdiwfp.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{81BC786A-E37C-4B2C-8FE3-F4D0D7469805}\WpadDecisionTime = 60a42b4154aeda01 wdiwfp.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-6c-6f-ad-72-fc\WpadDecisionReason = "1" wdiwfp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections wdiwfp.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 wdiwfp.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{81BC786A-E37C-4B2C-8FE3-F4D0D7469805} wdiwfp.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{81BC786A-E37C-4B2C-8FE3-F4D0D7469805}\WpadDecisionReason = "1" wdiwfp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings wdiwfp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad wdiwfp.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-6c-6f-ad-72-fc wdiwfp.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-6c-6f-ad-72-fc\WpadDecisionTime = 60a42b4154aeda01 wdiwfp.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exewdiwfp.exewdiwfp.exepid process 1636 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe 2032 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe 2640 wdiwfp.exe 2740 wdiwfp.exe 2740 wdiwfp.exe 2740 wdiwfp.exe 2740 wdiwfp.exe 2740 wdiwfp.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exepid process 2032 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exewdiwfp.exedescription pid process target process PID 1636 wrote to memory of 2032 1636 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe PID 1636 wrote to memory of 2032 1636 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe PID 1636 wrote to memory of 2032 1636 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe PID 1636 wrote to memory of 2032 1636 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe 70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe PID 2640 wrote to memory of 2740 2640 wdiwfp.exe wdiwfp.exe PID 2640 wrote to memory of 2740 2640 wdiwfp.exe wdiwfp.exe PID 2640 wrote to memory of 2740 2640 wdiwfp.exe wdiwfp.exe PID 2640 wrote to memory of 2740 2640 wdiwfp.exe wdiwfp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2032
-
C:\Windows\SysWOW64\wdiwfp.exe"C:\Windows\SysWOW64\wdiwfp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\wdiwfp.exe"C:\Windows\SysWOW64\wdiwfp.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1636-11-0x0000000000220000-0x0000000000230000-memory.dmpFilesize
64KB
-
memory/1636-10-0x0000000000270000-0x0000000000287000-memory.dmpFilesize
92KB
-
memory/1636-0-0x0000000000320000-0x0000000000337000-memory.dmpFilesize
92KB
-
memory/2032-13-0x0000000000220000-0x0000000000230000-memory.dmpFilesize
64KB
-
memory/2032-9-0x0000000000320000-0x0000000000337000-memory.dmpFilesize
92KB
-
memory/2032-12-0x0000000000300000-0x0000000000317000-memory.dmpFilesize
92KB
-
memory/2032-28-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2032-29-0x0000000000300000-0x0000000000317000-memory.dmpFilesize
92KB
-
memory/2640-15-0x00000000008C0000-0x00000000008D7000-memory.dmpFilesize
92KB
-
memory/2640-18-0x00000000008C0000-0x00000000008D7000-memory.dmpFilesize
92KB
-
memory/2640-25-0x00000000003A0000-0x00000000003B0000-memory.dmpFilesize
64KB
-
memory/2640-24-0x0000000000640000-0x0000000000657000-memory.dmpFilesize
92KB
-
memory/2740-27-0x00000000003C0000-0x00000000003D0000-memory.dmpFilesize
64KB
-
memory/2740-19-0x00000000007D0000-0x00000000007E7000-memory.dmpFilesize
92KB
-
memory/2740-26-0x0000000000660000-0x0000000000677000-memory.dmpFilesize
92KB
-
memory/2740-23-0x00000000007D0000-0x00000000007E7000-memory.dmpFilesize
92KB
-
memory/2740-30-0x0000000000660000-0x0000000000677000-memory.dmpFilesize
92KB