Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 00:35
Static task
static1
Behavioral task
behavioral1
Sample
73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe
-
Size
712KB
-
MD5
73c5cf6f7f25e7473322477646238a24
-
SHA1
0a51291e7395d2e5ecba73aedb762de155150c5f
-
SHA256
fef18503bd1483f6021e4cbe418a42045493769a15d69c0b59d99cf5be382997
-
SHA512
21712c3799f9dd065739727707907e895dd6e27a86bdef79e861cebb4ec90949a3d2d3dbf22e16b7d9c6e010713a45a631b33635b3ba5c184936722f8df52a06
-
SSDEEP
12288:W6qx+GgJOpEheBWpJ0NjYZZRKFdCFqPryQ32E9i/4B:8QlmWpJGYZZ4FsFEpn
Malware Config
Extracted
amadey
1.99
217.8.117.41/nbDcw2d/index.php
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
bdif.exepid process 2612 bdif.exe -
Loads dropped DLL 2 IoCs
Processes:
73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exepid process 2036 73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe 2036 73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1880 schtasks.exe 1940 schtasks.exe -
NTFS ADS 1 IoCs
Processes:
73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exedescription ioc process File created \??\c:\programdata\44def37582\bdif.exe:Zone.Identifier 73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exebdif.exepid process 2036 73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe 2612 bdif.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exebdif.execmd.execmd.exedescription pid process target process PID 2036 wrote to memory of 2612 2036 73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe bdif.exe PID 2036 wrote to memory of 2612 2036 73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe bdif.exe PID 2036 wrote to memory of 2612 2036 73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe bdif.exe PID 2036 wrote to memory of 2612 2036 73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe bdif.exe PID 2612 wrote to memory of 2164 2612 bdif.exe cmd.exe PID 2612 wrote to memory of 2164 2612 bdif.exe cmd.exe PID 2612 wrote to memory of 2164 2612 bdif.exe cmd.exe PID 2612 wrote to memory of 2164 2612 bdif.exe cmd.exe PID 2612 wrote to memory of 1256 2612 bdif.exe cmd.exe PID 2612 wrote to memory of 1256 2612 bdif.exe cmd.exe PID 2612 wrote to memory of 1256 2612 bdif.exe cmd.exe PID 2612 wrote to memory of 1256 2612 bdif.exe cmd.exe PID 2612 wrote to memory of 1600 2612 bdif.exe REG.exe PID 2612 wrote to memory of 1600 2612 bdif.exe REG.exe PID 2612 wrote to memory of 1600 2612 bdif.exe REG.exe PID 2612 wrote to memory of 1600 2612 bdif.exe REG.exe PID 2612 wrote to memory of 1868 2612 bdif.exe REG.exe PID 2612 wrote to memory of 1868 2612 bdif.exe REG.exe PID 2612 wrote to memory of 1868 2612 bdif.exe REG.exe PID 2612 wrote to memory of 1868 2612 bdif.exe REG.exe PID 2164 wrote to memory of 1880 2164 cmd.exe schtasks.exe PID 2164 wrote to memory of 1880 2164 cmd.exe schtasks.exe PID 2164 wrote to memory of 1880 2164 cmd.exe schtasks.exe PID 2164 wrote to memory of 1880 2164 cmd.exe schtasks.exe PID 1256 wrote to memory of 1940 1256 cmd.exe schtasks.exe PID 1256 wrote to memory of 1940 1256 cmd.exe schtasks.exe PID 1256 wrote to memory of 1940 1256 cmd.exe schtasks.exe PID 1256 wrote to memory of 1940 1256 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\programdata\44def37582\bdif.exec:\programdata\44def37582\bdif.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\44def375823⤵
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\44def375823⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86cMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\ProgramData\44def37582\bdif.exeFilesize
712KB
MD573c5cf6f7f25e7473322477646238a24
SHA10a51291e7395d2e5ecba73aedb762de155150c5f
SHA256fef18503bd1483f6021e4cbe418a42045493769a15d69c0b59d99cf5be382997
SHA51221712c3799f9dd065739727707907e895dd6e27a86bdef79e861cebb4ec90949a3d2d3dbf22e16b7d9c6e010713a45a631b33635b3ba5c184936722f8df52a06
-
memory/2036-4-0x00000000002C0000-0x00000000002E5000-memory.dmpFilesize
148KB
-
memory/2036-0-0x0000000000250000-0x0000000000260000-memory.dmpFilesize
64KB
-
memory/2036-15-0x0000000000240000-0x000000000024D000-memory.dmpFilesize
52KB
-
memory/2612-25-0x00000000002D0000-0x00000000002E0000-memory.dmpFilesize
64KB
-
memory/2612-29-0x0000000000380000-0x00000000003A5000-memory.dmpFilesize
148KB