Analysis
-
max time kernel
132s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 12:24
Behavioral task
behavioral1
Sample
7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe
-
Size
16KB
-
MD5
7925400a7db00d3b6a11c49d522255f5
-
SHA1
d819e355aca3db47d1affbba72081ec9d6c2ce5c
-
SHA256
246e374106f294a24b21de1875b09d9ac778aa1dd744bb3b6795078156f5a18a
-
SHA512
de676ea34696f9bd723276f5d779cd700abd626283e7cce86d137aa5fe91bf0ce3311bea10866eb45e25dd6dc7072a0fd39abbae94fcfb00c1d184b150b6359a
-
SSDEEP
384:umDvAPDVH19GTXjdh9EuujYcV6AUwJFZb:uqyRV9AhGfYcV6Dw9b
Malware Config
Extracted
loaderbot
http://freebi8o.beget.tech/cmd.php
Signatures
-
LoaderBot executable 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1760-1-0x0000000000270000-0x000000000027A000-memory.dmp loaderbot -
Drops startup file 1 IoCs
Processes:
7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url 7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe" 7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exepid process 1760 7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exepid process 1760 7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1760 7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.execmd.exedescription pid process target process PID 1760 wrote to memory of 2748 1760 7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe cmd.exe PID 1760 wrote to memory of 2748 1760 7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe cmd.exe PID 1760 wrote to memory of 2748 1760 7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe cmd.exe PID 1760 wrote to memory of 2748 1760 7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe cmd.exe PID 2748 wrote to memory of 2936 2748 cmd.exe schtasks.exe PID 2748 wrote to memory of 2936 2748 cmd.exe schtasks.exe PID 2748 wrote to memory of 2936 2748 cmd.exe schtasks.exe PID 2748 wrote to memory of 2936 2748 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\7925400a7db00d3b6a11c49d522255f5_JaffaCakes118.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1760-0-0x0000000073DEE000-0x0000000073DEF000-memory.dmpFilesize
4KB
-
memory/1760-1-0x0000000000270000-0x000000000027A000-memory.dmpFilesize
40KB
-
memory/1760-3-0x0000000073DE0000-0x00000000744CE000-memory.dmpFilesize
6.9MB
-
memory/1760-4-0x0000000073DEE000-0x0000000073DEF000-memory.dmpFilesize
4KB
-
memory/1760-5-0x0000000073DE0000-0x00000000744CE000-memory.dmpFilesize
6.9MB