Analysis
-
max time kernel
132s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 06:49
Static task
static1
Behavioral task
behavioral1
Sample
712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe
-
Size
132KB
-
MD5
712bc394783d08b87c9e2e8723d6ea38
-
SHA1
94057a04b6c659415b5dde9023447e672fc73726
-
SHA256
a88d8031014957d8f2bbc3d09cf48583cbcbe701b17d714d746dc3d85a8464cf
-
SHA512
a2a66d905e7811fbed6b3e8fc0d8fb99a927e19f4de9f3f72f336cf1aea8122180372f9a45bde7ecb7c7e364e6f7b67c22726c74a94798be14cb0f8cfd277fcd
-
SSDEEP
3072:HvxjJ/je1wTbl0qBIEwRH13C/1hLp85jVfNOiHYugSaLjzywOTpzs0+9e0XenQzS:HN1e1wTbl0qBIEwRH13C/1hLp85jVfNz
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
webcamtlnt.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat webcamtlnt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 22 IoCs
Processes:
webcamtlnt.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 webcamtlnt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 webcamtlnt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42EAB913-04D4-46EF-ACEF-0F3688684EBD}\WpadDecisionTime = 60e548fe6faeda01 webcamtlnt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-ab-b5-a6-88-89\WpadDecisionReason = "1" webcamtlnt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-ab-b5-a6-88-89\WpadDecisionTime = 60a834c86faeda01 webcamtlnt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-ab-b5-a6-88-89\WpadDecisionTime = 60e548fe6faeda01 webcamtlnt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings webcamtlnt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections webcamtlnt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 webcamtlnt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" webcamtlnt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 webcamtlnt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42EAB913-04D4-46EF-ACEF-0F3688684EBD}\WpadDecisionReason = "1" webcamtlnt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42EAB913-04D4-46EF-ACEF-0F3688684EBD}\WpadDecisionTime = 60a834c86faeda01 webcamtlnt.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42EAB913-04D4-46EF-ACEF-0F3688684EBD}\WpadNetworkName = "Network 3" webcamtlnt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42EAB913-04D4-46EF-ACEF-0F3688684EBD}\ca-ab-b5-a6-88-89 webcamtlnt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-ab-b5-a6-88-89\WpadDecision = "0" webcamtlnt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings webcamtlnt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad webcamtlnt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42EAB913-04D4-46EF-ACEF-0F3688684EBD} webcamtlnt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42EAB913-04D4-46EF-ACEF-0F3688684EBD}\WpadDecision = "0" webcamtlnt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-ab-b5-a6-88-89 webcamtlnt.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-ab-b5-a6-88-89\WpadDetectedUrl webcamtlnt.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exewebcamtlnt.exewebcamtlnt.exepid process 1192 712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe 2124 712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe 1332 webcamtlnt.exe 2972 webcamtlnt.exe 2972 webcamtlnt.exe 2972 webcamtlnt.exe 2972 webcamtlnt.exe 2972 webcamtlnt.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exepid process 2124 712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exewebcamtlnt.exedescription pid process target process PID 1192 wrote to memory of 2124 1192 712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe 712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe PID 1192 wrote to memory of 2124 1192 712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe 712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe PID 1192 wrote to memory of 2124 1192 712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe 712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe PID 1192 wrote to memory of 2124 1192 712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe 712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe PID 1332 wrote to memory of 2972 1332 webcamtlnt.exe webcamtlnt.exe PID 1332 wrote to memory of 2972 1332 webcamtlnt.exe webcamtlnt.exe PID 1332 wrote to memory of 2972 1332 webcamtlnt.exe webcamtlnt.exe PID 1332 wrote to memory of 2972 1332 webcamtlnt.exe webcamtlnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\712bc394783d08b87c9e2e8723d6ea38_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2124
-
C:\Windows\SysWOW64\webcamtlnt.exe"C:\Windows\SysWOW64\webcamtlnt.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\webcamtlnt.exe"C:\Windows\SysWOW64\webcamtlnt.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1192-11-0x0000000000140000-0x0000000000160000-memory.dmpFilesize
128KB
-
memory/1192-0-0x0000000000120000-0x0000000000139000-memory.dmpFilesize
100KB
-
memory/1192-4-0x0000000000120000-0x0000000000139000-memory.dmpFilesize
100KB
-
memory/1192-10-0x0000000000100000-0x0000000000119000-memory.dmpFilesize
100KB
-
memory/1332-18-0x00000000003F0000-0x0000000000409000-memory.dmpFilesize
100KB
-
memory/1332-14-0x00000000003F0000-0x0000000000409000-memory.dmpFilesize
100KB
-
memory/1332-19-0x0000000000100000-0x0000000000119000-memory.dmpFilesize
100KB
-
memory/1332-20-0x0000000000410000-0x0000000000430000-memory.dmpFilesize
128KB
-
memory/2124-12-0x00000000000D0000-0x00000000000E9000-memory.dmpFilesize
100KB
-
memory/2124-13-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2124-5-0x0000000000320000-0x0000000000339000-memory.dmpFilesize
100KB
-
memory/2124-9-0x0000000000320000-0x0000000000339000-memory.dmpFilesize
100KB
-
memory/2124-29-0x00000000000D0000-0x00000000000E9000-memory.dmpFilesize
100KB
-
memory/2124-27-0x0000000000ED0000-0x0000000000EF3000-memory.dmpFilesize
140KB
-
memory/2972-21-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2972-26-0x0000000000140000-0x0000000000159000-memory.dmpFilesize
100KB
-
memory/2972-28-0x0000000000650000-0x0000000000670000-memory.dmpFilesize
128KB
-
memory/2972-30-0x0000000000140000-0x0000000000159000-memory.dmpFilesize
100KB