Analysis
-
max time kernel
140s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 00:35
Static task
static1
Behavioral task
behavioral1
Sample
73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe
-
Size
712KB
-
MD5
73c5cf6f7f25e7473322477646238a24
-
SHA1
0a51291e7395d2e5ecba73aedb762de155150c5f
-
SHA256
fef18503bd1483f6021e4cbe418a42045493769a15d69c0b59d99cf5be382997
-
SHA512
21712c3799f9dd065739727707907e895dd6e27a86bdef79e861cebb4ec90949a3d2d3dbf22e16b7d9c6e010713a45a631b33635b3ba5c184936722f8df52a06
-
SSDEEP
12288:W6qx+GgJOpEheBWpJ0NjYZZRKFdCFqPryQ32E9i/4B:8QlmWpJGYZZ4FsFEpn
Malware Config
Extracted
amadey
1.99
217.8.117.41/nbDcw2d/index.php
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
bdif.exepid process 2460 bdif.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4628 schtasks.exe 1712 schtasks.exe -
NTFS ADS 1 IoCs
Processes:
73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exedescription ioc process File created \??\c:\programdata\44def37582\bdif.exe:Zone.Identifier 73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exebdif.exepid process 1072 73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe 2460 bdif.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exebdif.execmd.execmd.exedescription pid process target process PID 1072 wrote to memory of 2460 1072 73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe bdif.exe PID 1072 wrote to memory of 2460 1072 73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe bdif.exe PID 1072 wrote to memory of 2460 1072 73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe bdif.exe PID 2460 wrote to memory of 3048 2460 bdif.exe cmd.exe PID 2460 wrote to memory of 3048 2460 bdif.exe cmd.exe PID 2460 wrote to memory of 3048 2460 bdif.exe cmd.exe PID 2460 wrote to memory of 5060 2460 bdif.exe cmd.exe PID 2460 wrote to memory of 5060 2460 bdif.exe cmd.exe PID 2460 wrote to memory of 5060 2460 bdif.exe cmd.exe PID 2460 wrote to memory of 3852 2460 bdif.exe REG.exe PID 2460 wrote to memory of 3852 2460 bdif.exe REG.exe PID 2460 wrote to memory of 3852 2460 bdif.exe REG.exe PID 2460 wrote to memory of 4964 2460 bdif.exe REG.exe PID 2460 wrote to memory of 4964 2460 bdif.exe REG.exe PID 2460 wrote to memory of 4964 2460 bdif.exe REG.exe PID 5060 wrote to memory of 4628 5060 cmd.exe schtasks.exe PID 5060 wrote to memory of 4628 5060 cmd.exe schtasks.exe PID 5060 wrote to memory of 4628 5060 cmd.exe schtasks.exe PID 3048 wrote to memory of 1712 3048 cmd.exe schtasks.exe PID 3048 wrote to memory of 1712 3048 cmd.exe schtasks.exe PID 3048 wrote to memory of 1712 3048 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\73c5cf6f7f25e7473322477646238a24_JaffaCakes118.exe"1⤵
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\programdata\44def37582\bdif.exec:\programdata\44def37582\bdif.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\cmd.execmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe3⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe4⤵
- Creates scheduled task(s)
PID:4628 -
C:\Windows\SysWOW64\cmd.execmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe4⤵
- Creates scheduled task(s)
PID:1712 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\44def375823⤵PID:4964
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\44def375823⤵PID:3852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\44def37582\bdif.exeFilesize
712KB
MD573c5cf6f7f25e7473322477646238a24
SHA10a51291e7395d2e5ecba73aedb762de155150c5f
SHA256fef18503bd1483f6021e4cbe418a42045493769a15d69c0b59d99cf5be382997
SHA51221712c3799f9dd065739727707907e895dd6e27a86bdef79e861cebb4ec90949a3d2d3dbf22e16b7d9c6e010713a45a631b33635b3ba5c184936722f8df52a06
-
C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86cMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1072-1-0x0000000002170000-0x0000000002180000-memory.dmpFilesize
64KB
-
memory/1072-4-0x0000000002160000-0x000000000216D000-memory.dmpFilesize
52KB
-
memory/1072-5-0x0000000002190000-0x00000000021B5000-memory.dmpFilesize
148KB
-
memory/1072-20-0x0000000002150000-0x0000000002158000-memory.dmpFilesize
32KB
-
memory/2460-26-0x00000000021A0000-0x00000000021C5000-memory.dmpFilesize
148KB
-
memory/2460-22-0x00000000020F0000-0x0000000002100000-memory.dmpFilesize
64KB
-
memory/2460-45-0x00000000020D0000-0x00000000020D8000-memory.dmpFilesize
32KB