Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 07:37
Static task
static1
Behavioral task
behavioral1
Sample
7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe
-
Size
215KB
-
MD5
7146abc7e87f02c48e85cb903a197b6f
-
SHA1
da9a9e256e5a37be885f306831ba7637d305e36b
-
SHA256
96be5b3103eabba9015ff9a80543e63540a8ac3ac6b979f527af0f2e5d06b0f2
-
SHA512
1f1295fe6de58497b887a86fa5df42900009ffbf771436dcbebdc50945d94de4ff013112ca70d114e6f0dcda0ec58897313ac3152e7bcca6d838d3ce7996f0a0
-
SSDEEP
3072:1myVc6uHa8yCjHyMOt2zsanfsQZpw/lDp2bJ:LC9LTjHyMNfnfsQE/1W
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
computedim.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat computedim.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 19 IoCs
Processes:
computedim.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42FB9790-6191-40B8-8E9C-954FB96BA2BE}\WpadDecisionReason = "1" computedim.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42FB9790-6191-40B8-8E9C-954FB96BA2BE}\WpadNetworkName = "Network 3" computedim.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\da-8b-f8-21-78-f7\WpadDetectedUrl computedim.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" computedim.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42FB9790-6191-40B8-8E9C-954FB96BA2BE} computedim.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 computedim.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0137000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 computedim.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42FB9790-6191-40B8-8E9C-954FB96BA2BE}\WpadDecision = "0" computedim.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42FB9790-6191-40B8-8E9C-954FB96BA2BE}\da-8b-f8-21-78-f7 computedim.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings computedim.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings computedim.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\da-8b-f8-21-78-f7\WpadDecisionTime = 6041a46876aeda01 computedim.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\da-8b-f8-21-78-f7\WpadDecision = "0" computedim.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 computedim.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42FB9790-6191-40B8-8E9C-954FB96BA2BE}\WpadDecisionTime = 6041a46876aeda01 computedim.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\da-8b-f8-21-78-f7 computedim.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\da-8b-f8-21-78-f7\WpadDecisionReason = "1" computedim.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections computedim.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad computedim.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.execomputedim.execomputedim.exepid process 3028 7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe 2492 7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe 2648 computedim.exe 2636 computedim.exe 2636 computedim.exe 2636 computedim.exe 2636 computedim.exe 2636 computedim.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exepid process 2492 7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.execomputedim.exedescription pid process target process PID 3028 wrote to memory of 2492 3028 7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe 7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe PID 3028 wrote to memory of 2492 3028 7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe 7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe PID 3028 wrote to memory of 2492 3028 7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe 7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe PID 3028 wrote to memory of 2492 3028 7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe 7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe PID 2648 wrote to memory of 2636 2648 computedim.exe computedim.exe PID 2648 wrote to memory of 2636 2648 computedim.exe computedim.exe PID 2648 wrote to memory of 2636 2648 computedim.exe computedim.exe PID 2648 wrote to memory of 2636 2648 computedim.exe computedim.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2492
-
C:\Windows\SysWOW64\computedim.exe"C:\Windows\SysWOW64\computedim.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\computedim.exe"C:\Windows\SysWOW64\computedim.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2492-12-0x0000000000270000-0x0000000000287000-memory.dmpFilesize
92KB
-
memory/2492-30-0x0000000000270000-0x0000000000287000-memory.dmpFilesize
92KB
-
memory/2492-29-0x0000000000950000-0x0000000000989000-memory.dmpFilesize
228KB
-
memory/2492-13-0x00000000002B0000-0x00000000002C0000-memory.dmpFilesize
64KB
-
memory/2492-11-0x0000000000290000-0x00000000002A7000-memory.dmpFilesize
92KB
-
memory/2492-8-0x0000000000290000-0x00000000002A7000-memory.dmpFilesize
92KB
-
memory/2636-26-0x00000000003D0000-0x00000000003E7000-memory.dmpFilesize
92KB
-
memory/2636-21-0x00000000003F0000-0x0000000000407000-memory.dmpFilesize
92KB
-
memory/2636-31-0x00000000003D0000-0x00000000003E7000-memory.dmpFilesize
92KB
-
memory/2636-27-0x0000000000410000-0x0000000000420000-memory.dmpFilesize
64KB
-
memory/2636-25-0x00000000003F0000-0x0000000000407000-memory.dmpFilesize
92KB
-
memory/2648-15-0x00000000001A0000-0x00000000001B7000-memory.dmpFilesize
92KB
-
memory/2648-20-0x00000000001C0000-0x00000000001D0000-memory.dmpFilesize
64KB
-
memory/2648-19-0x00000000001A0000-0x00000000001B7000-memory.dmpFilesize
92KB
-
memory/2648-28-0x0000000000180000-0x0000000000197000-memory.dmpFilesize
92KB
-
memory/2648-14-0x0000000000180000-0x0000000000197000-memory.dmpFilesize
92KB
-
memory/3028-5-0x0000000000710000-0x0000000000727000-memory.dmpFilesize
92KB
-
memory/3028-0-0x0000000000730000-0x0000000000747000-memory.dmpFilesize
92KB
-
memory/3028-6-0x0000000000750000-0x0000000000760000-memory.dmpFilesize
64KB
-
memory/3028-4-0x0000000000730000-0x0000000000747000-memory.dmpFilesize
92KB