Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe
Resource
win7-20240508-en
7 signatures
150 seconds
General
-
Target
8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe
-
Size
132KB
-
MD5
8c7ebd739990c20d34ee9da707747bc2
-
SHA1
f489878f1ea6b00221cb168b749764b5ebb9d364
-
SHA256
75ace839beaa44438502a83dbd2aed5ab8c206700c63a20d1e1425228fc29bf4
-
SHA512
2533fa3fd68e5e31b27d748518004697deed40b8591fcc57edaba6721f21d3cf6175b2c19bc50da7fcf261fb932dee02a1d0105e9749099241bbeb07ebc5b966
-
SSDEEP
3072:LZ/7FQbks58kW7FJBbUBxO7e8wxWLvJAEDO1Al+QQb:LZc5GrZJJUB0e8wyBpa1Ap
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
porttograph.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat porttograph.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 19 IoCs
Processes:
porttograph.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections porttograph.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 porttograph.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42EAB913-04D4-46EF-ACEF-0F3688684EBD}\ca-ab-b5-a6-88-89 porttograph.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-ab-b5-a6-88-89\WpadDetectedUrl porttograph.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42EAB913-04D4-46EF-ACEF-0F3688684EBD}\WpadDecision = "0" porttograph.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings porttograph.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings porttograph.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad porttograph.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42EAB913-04D4-46EF-ACEF-0F3688684EBD} porttograph.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42EAB913-04D4-46EF-ACEF-0F3688684EBD}\WpadDecisionReason = "1" porttograph.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 porttograph.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-ab-b5-a6-88-89 porttograph.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-ab-b5-a6-88-89\WpadDecisionTime = e0ccc30b8eb4da01 porttograph.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-ab-b5-a6-88-89\WpadDecision = "0" porttograph.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" porttograph.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 porttograph.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42EAB913-04D4-46EF-ACEF-0F3688684EBD}\WpadDecisionTime = e0ccc30b8eb4da01 porttograph.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42EAB913-04D4-46EF-ACEF-0F3688684EBD}\WpadNetworkName = "Network 3" porttograph.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-ab-b5-a6-88-89\WpadDecisionReason = "1" porttograph.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exeporttograph.exeporttograph.exepid process 2080 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe 3008 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe 2776 porttograph.exe 3060 porttograph.exe 3060 porttograph.exe 3060 porttograph.exe 3060 porttograph.exe 3060 porttograph.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exepid process 3008 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exeporttograph.exedescription pid process target process PID 2080 wrote to memory of 3008 2080 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe PID 2080 wrote to memory of 3008 2080 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe PID 2080 wrote to memory of 3008 2080 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe PID 2080 wrote to memory of 3008 2080 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe PID 2776 wrote to memory of 3060 2776 porttograph.exe porttograph.exe PID 2776 wrote to memory of 3060 2776 porttograph.exe porttograph.exe PID 2776 wrote to memory of 3060 2776 porttograph.exe porttograph.exe PID 2776 wrote to memory of 3060 2776 porttograph.exe porttograph.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:3008
-
C:\Windows\SysWOW64\porttograph.exe"C:\Windows\SysWOW64\porttograph.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\porttograph.exe"C:\Windows\SysWOW64\porttograph.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3060