Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 15:56
Static task
static1
Behavioral task
behavioral1
Sample
aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe
-
Size
404KB
-
MD5
aa8d56b5908a2dd5c99f079fd2817886
-
SHA1
082ada8d53fc3c491113ffaa8c5f96a1eecbecbd
-
SHA256
bbd2a50b5e30c3c84c9d1a4ec6a3a8af298f5125b4803b668df14b6ba6a01c24
-
SHA512
3711b5219e900ae64768f71047b6c9c84eaaed7d34f2c184e05db772e67c67fbe61d02d28907fb1fcf5bb7ed2b6d244c16f8ebe9ab8b08f960ffb5b30176934a
-
SSDEEP
6144:KvlmnzWpaM+Qtpz8pgm7wcJiKK4oggV9HFtBN/ro5HBgo04:KvlmnzFTQtpzAWPKHtgV93eGz4
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
bangsearcha.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat bangsearcha.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 18 IoCs
Processes:
bangsearcha.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3427FCC5-CBBD-4367-868C-DC9FD2964E81}\WpadDecision = "0" bangsearcha.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-39-73-23-ea-94\WpadDecision = "0" bangsearcha.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" bangsearcha.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bangsearcha.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bangsearcha.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings bangsearcha.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad bangsearcha.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-39-73-23-ea-94 bangsearcha.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3427FCC5-CBBD-4367-868C-DC9FD2964E81}\WpadDecisionReason = "1" bangsearcha.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3427FCC5-CBBD-4367-868C-DC9FD2964E81}\WpadDecisionTime = 5023ecbe73beda01 bangsearcha.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3427FCC5-CBBD-4367-868C-DC9FD2964E81}\96-39-73-23-ea-94 bangsearcha.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-39-73-23-ea-94\WpadDecisionReason = "1" bangsearcha.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections bangsearcha.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bangsearcha.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3427FCC5-CBBD-4367-868C-DC9FD2964E81} bangsearcha.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings bangsearcha.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3427FCC5-CBBD-4367-868C-DC9FD2964E81}\WpadNetworkName = "Network 3" bangsearcha.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-39-73-23-ea-94\WpadDecisionTime = 5023ecbe73beda01 bangsearcha.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exeaa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exebangsearcha.exebangsearcha.exebangsearcha.exepid process 2408 aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe 2580 aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe 2736 bangsearcha.exe 1716 bangsearcha.exe 1664 bangsearcha.exe 1664 bangsearcha.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exepid process 2580 aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exebangsearcha.exebangsearcha.exedescription pid process target process PID 2408 wrote to memory of 2580 2408 aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe PID 2408 wrote to memory of 2580 2408 aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe PID 2408 wrote to memory of 2580 2408 aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe PID 2408 wrote to memory of 2580 2408 aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe PID 2736 wrote to memory of 1716 2736 bangsearcha.exe bangsearcha.exe PID 2736 wrote to memory of 1716 2736 bangsearcha.exe bangsearcha.exe PID 2736 wrote to memory of 1716 2736 bangsearcha.exe bangsearcha.exe PID 2736 wrote to memory of 1716 2736 bangsearcha.exe bangsearcha.exe PID 1716 wrote to memory of 1664 1716 bangsearcha.exe bangsearcha.exe PID 1716 wrote to memory of 1664 1716 bangsearcha.exe bangsearcha.exe PID 1716 wrote to memory of 1664 1716 bangsearcha.exe bangsearcha.exe PID 1716 wrote to memory of 1664 1716 bangsearcha.exe bangsearcha.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aa8d56b5908a2dd5c99f079fd2817886_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\bangsearcha.exe"C:\Windows\SysWOW64\bangsearcha.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\bangsearcha.exe"C:\Windows\SysWOW64\bangsearcha.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\bangsearcha.exe"C:\Windows\SysWOW64\bangsearcha.exe"3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1664-29-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB
-
memory/1664-28-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB
-
memory/1664-27-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB
-
memory/1664-25-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB
-
memory/1716-20-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB
-
memory/1716-21-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB
-
memory/2408-2-0x0000000000BEA000-0x0000000000BEE000-memory.dmpFilesize
16KB
-
memory/2408-0-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB
-
memory/2408-3-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB
-
memory/2580-7-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB
-
memory/2580-18-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB
-
memory/2580-10-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB
-
memory/2580-9-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB
-
memory/2736-15-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB
-
memory/2736-13-0x0000000000BB0000-0x0000000000C2B000-memory.dmpFilesize
492KB