Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 13:33
Behavioral task
behavioral1
Sample
a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe
-
Size
4.5MB
-
MD5
a5cf03ec2743a308c28b34fcc9e4ce82
-
SHA1
753310811c446f92ef42ed571c50151c34f1e9d8
-
SHA256
a8c3da49f118c1c3e671b6e48c58c6c6ba791ccb897c668858e5d385e12ffc69
-
SHA512
dd6c43925d38823567d7dcd84c3ebe15ff67cb1a9bfd3409c74606f2b0023e082a93d600f475400c895bb85516a2394f99af6962fad72e79b45b5a4e66fa15b7
-
SSDEEP
98304:brEIOWdgFzJitZRUKkGL1L4vOYKd389SneGd+wMjZInR:brEnWdgBwszGhL4vODgSneGtnR
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/756-0-0x0000000000F00000-0x0000000001C74000-memory.dmp upx behavioral1/memory/756-26-0x0000000000F00000-0x0000000001C74000-memory.dmp upx behavioral1/memory/1644-27-0x0000000000F00000-0x0000000001C74000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exedescription pid process target process PID 756 set thread context of 1644 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exepid process 1644 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe 1644 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exea5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exepid process 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe 1644 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe 1644 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe 1644 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe 1644 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exedescription pid process target process PID 756 wrote to memory of 1644 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe PID 756 wrote to memory of 1644 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe PID 756 wrote to memory of 1644 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe PID 756 wrote to memory of 1644 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe PID 756 wrote to memory of 1644 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe PID 756 wrote to memory of 1644 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe PID 756 wrote to memory of 1644 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe PID 756 wrote to memory of 1644 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe PID 756 wrote to memory of 1644 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe PID 756 wrote to memory of 1644 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe PID 756 wrote to memory of 1644 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe PID 756 wrote to memory of 1644 756 a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5cf03ec2743a308c28b34fcc9e4ce82_JaffaCakes118.exe"2⤵
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/756-0-0x0000000000F00000-0x0000000001C74000-memory.dmpFilesize
13.5MB
-
memory/756-1-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/756-2-0x00000000040B0000-0x0000000004E24000-memory.dmpFilesize
13.5MB
-
memory/756-26-0x0000000000F00000-0x0000000001C74000-memory.dmpFilesize
13.5MB
-
memory/1644-24-0x0000000000400000-0x00000000007AF000-memory.dmpFilesize
3.7MB
-
memory/1644-3-0x0000000000400000-0x00000000007AF000-memory.dmpFilesize
3.7MB
-
memory/1644-7-0x0000000000400000-0x00000000007AF000-memory.dmpFilesize
3.7MB
-
memory/1644-10-0x0000000000400000-0x00000000007AF000-memory.dmpFilesize
3.7MB
-
memory/1644-13-0x0000000000400000-0x00000000007AF000-memory.dmpFilesize
3.7MB
-
memory/1644-16-0x0000000000400000-0x00000000007AF000-memory.dmpFilesize
3.7MB
-
memory/1644-19-0x0000000000400000-0x00000000007AF000-memory.dmpFilesize
3.7MB
-
memory/1644-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1644-4-0x0000000000400000-0x00000000007AF000-memory.dmpFilesize
3.7MB
-
memory/1644-5-0x0000000000400000-0x00000000007AF000-memory.dmpFilesize
3.7MB
-
memory/1644-23-0x0000000000400000-0x00000000007AF000-memory.dmpFilesize
3.7MB
-
memory/1644-27-0x0000000000F00000-0x0000000001C74000-memory.dmpFilesize
13.5MB
-
memory/1644-29-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/1644-28-0x0000000000400000-0x00000000007AF000-memory.dmpFilesize
3.7MB
-
memory/1644-30-0x00000000046B0000-0x0000000005424000-memory.dmpFilesize
13.5MB
-
memory/1644-32-0x00000000045C0000-0x00000000045D0000-memory.dmpFilesize
64KB
-
memory/1644-33-0x0000000000400000-0x00000000007AF000-memory.dmpFilesize
3.7MB
-
memory/1644-34-0x0000000000400000-0x00000000007AF000-memory.dmpFilesize
3.7MB
-
memory/1644-35-0x00000000046B0000-0x0000000005424000-memory.dmpFilesize
13.5MB
-
memory/1644-36-0x00000000045C0000-0x00000000045D0000-memory.dmpFilesize
64KB