Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 16:42
Static task
static1
Behavioral task
behavioral1
Sample
761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe
-
Size
712KB
-
MD5
761fd3f46be0c4b7440fc719a88495ec
-
SHA1
b49e740f68fc8882939111dc6a0b1bf27d738b51
-
SHA256
ab4266beccfd9680846605cae4639ad76fb624622e019cd99efc3821213f6bf1
-
SHA512
a1845e618b67c89cd6e958a4b2f4f4f46bb2b8b622df13bb7ba1568e349d29e19d62b2e3dc62589bc32db265c9d1caa2c2ca03efc84f463feded1a6cc028f15f
-
SSDEEP
12288:W6qx+GgJOpEheBWpJ0NjYZZRKFdCFqPryQ32E9i/4B:8QlmWpJGYZZ4FsFEpn
Malware Config
Extracted
amadey
1.99
217.8.117.41/nbDcw2d/index.php
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
bdif.exepid process 2692 bdif.exe -
Loads dropped DLL 2 IoCs
Processes:
761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exepid process 1244 761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe 1244 761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1996 schtasks.exe 2176 schtasks.exe -
NTFS ADS 1 IoCs
Processes:
761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exedescription ioc process File created \??\c:\programdata\44def37582\bdif.exe:Zone.Identifier 761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exebdif.exepid process 1244 761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe 2692 bdif.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exebdif.execmd.execmd.exedescription pid process target process PID 1244 wrote to memory of 2692 1244 761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe bdif.exe PID 1244 wrote to memory of 2692 1244 761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe bdif.exe PID 1244 wrote to memory of 2692 1244 761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe bdif.exe PID 1244 wrote to memory of 2692 1244 761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe bdif.exe PID 2692 wrote to memory of 2844 2692 bdif.exe cmd.exe PID 2692 wrote to memory of 2844 2692 bdif.exe cmd.exe PID 2692 wrote to memory of 2844 2692 bdif.exe cmd.exe PID 2692 wrote to memory of 2844 2692 bdif.exe cmd.exe PID 2692 wrote to memory of 2860 2692 bdif.exe REG.exe PID 2692 wrote to memory of 2860 2692 bdif.exe REG.exe PID 2692 wrote to memory of 2860 2692 bdif.exe REG.exe PID 2692 wrote to memory of 2860 2692 bdif.exe REG.exe PID 2844 wrote to memory of 1996 2844 cmd.exe schtasks.exe PID 2844 wrote to memory of 1996 2844 cmd.exe schtasks.exe PID 2844 wrote to memory of 1996 2844 cmd.exe schtasks.exe PID 2844 wrote to memory of 1996 2844 cmd.exe schtasks.exe PID 2692 wrote to memory of 2172 2692 bdif.exe cmd.exe PID 2692 wrote to memory of 2172 2692 bdif.exe cmd.exe PID 2692 wrote to memory of 2172 2692 bdif.exe cmd.exe PID 2692 wrote to memory of 2172 2692 bdif.exe cmd.exe PID 2692 wrote to memory of 2208 2692 bdif.exe REG.exe PID 2692 wrote to memory of 2208 2692 bdif.exe REG.exe PID 2692 wrote to memory of 2208 2692 bdif.exe REG.exe PID 2692 wrote to memory of 2208 2692 bdif.exe REG.exe PID 2172 wrote to memory of 2176 2172 cmd.exe schtasks.exe PID 2172 wrote to memory of 2176 2172 cmd.exe schtasks.exe PID 2172 wrote to memory of 2176 2172 cmd.exe schtasks.exe PID 2172 wrote to memory of 2176 2172 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\programdata\44def37582\bdif.exec:\programdata\44def37582\bdif.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.execmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe4⤵
- Creates scheduled task(s)
PID:1996 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\44def375823⤵PID:2860
-
C:\Windows\SysWOW64\cmd.execmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe4⤵
- Creates scheduled task(s)
PID:2176 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\44def375823⤵PID:2208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\44def37582\bdif.exeFilesize
712KB
MD5761fd3f46be0c4b7440fc719a88495ec
SHA1b49e740f68fc8882939111dc6a0b1bf27d738b51
SHA256ab4266beccfd9680846605cae4639ad76fb624622e019cd99efc3821213f6bf1
SHA512a1845e618b67c89cd6e958a4b2f4f4f46bb2b8b622df13bb7ba1568e349d29e19d62b2e3dc62589bc32db265c9d1caa2c2ca03efc84f463feded1a6cc028f15f
-
C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86cMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1244-0-0x0000000000240000-0x0000000000250000-memory.dmpFilesize
64KB
-
memory/1244-4-0x0000000000250000-0x0000000000275000-memory.dmpFilesize
148KB
-
memory/1244-17-0x0000000000230000-0x000000000023D000-memory.dmpFilesize
52KB
-
memory/1244-10-0x0000000000250000-0x0000000000275000-memory.dmpFilesize
148KB
-
memory/2692-29-0x0000000000360000-0x0000000000385000-memory.dmpFilesize
148KB
-
memory/2692-25-0x00000000002D0000-0x00000000002E0000-memory.dmpFilesize
64KB