Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 16:56
Static task
static1
Behavioral task
behavioral1
Sample
aac83167081b7d228931845c006253f6_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
aac83167081b7d228931845c006253f6_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
aac83167081b7d228931845c006253f6_JaffaCakes118.exe
-
Size
204KB
-
MD5
aac83167081b7d228931845c006253f6
-
SHA1
9aa9d909930c7f9279fcd223960b5671dd3ef52e
-
SHA256
7efc8446996e148dcf5b6f490899f588c97cd1140b867098943f6a2b486fcc5a
-
SHA512
4b54e8c6d11e99c21bf066853e75a4abee949822cdee25e38d9f571e97f09d5d30974055b04fc3d31252d084eba04c736544a54b182555ad37eafceaf9eafe27
-
SSDEEP
3072:dlX2r1VTrT63z+30fE7IjeHU9DtAZelbHKtfwgs9PPJ8wxsdOqsJ3MBTyv//:/2DrCSRrk5jT9OOqsJMBmP
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
lookpack.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat lookpack.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 19 IoCs
Processes:
lookpack.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings lookpack.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7E5073D5-B405-48C4-8C63-CEAD662EA775}\WpadDecisionTime = 70f1fce97bbeda01 lookpack.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-df-74-b6-a7-0a lookpack.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-df-74-b6-a7-0a\WpadDecisionTime = 70f1fce97bbeda01 lookpack.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 lookpack.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0028000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 lookpack.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7E5073D5-B405-48C4-8C63-CEAD662EA775}\WpadDecisionReason = "1" lookpack.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7E5073D5-B405-48C4-8C63-CEAD662EA775}\WpadNetworkName = "Network 3" lookpack.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-df-74-b6-a7-0a\WpadDecisionReason = "1" lookpack.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-df-74-b6-a7-0a\WpadDecision = "0" lookpack.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-df-74-b6-a7-0a\WpadDetectedUrl lookpack.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections lookpack.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings lookpack.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" lookpack.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad lookpack.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7E5073D5-B405-48C4-8C63-CEAD662EA775} lookpack.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 lookpack.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7E5073D5-B405-48C4-8C63-CEAD662EA775}\WpadDecision = "0" lookpack.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7E5073D5-B405-48C4-8C63-CEAD662EA775}\7a-df-74-b6-a7-0a lookpack.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
aac83167081b7d228931845c006253f6_JaffaCakes118.exeaac83167081b7d228931845c006253f6_JaffaCakes118.exelookpack.exelookpack.exepid process 2420 aac83167081b7d228931845c006253f6_JaffaCakes118.exe 2372 aac83167081b7d228931845c006253f6_JaffaCakes118.exe 3036 lookpack.exe 2612 lookpack.exe 2612 lookpack.exe 2612 lookpack.exe 2612 lookpack.exe 2612 lookpack.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
aac83167081b7d228931845c006253f6_JaffaCakes118.exepid process 2372 aac83167081b7d228931845c006253f6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
aac83167081b7d228931845c006253f6_JaffaCakes118.exelookpack.exedescription pid process target process PID 2420 wrote to memory of 2372 2420 aac83167081b7d228931845c006253f6_JaffaCakes118.exe aac83167081b7d228931845c006253f6_JaffaCakes118.exe PID 2420 wrote to memory of 2372 2420 aac83167081b7d228931845c006253f6_JaffaCakes118.exe aac83167081b7d228931845c006253f6_JaffaCakes118.exe PID 2420 wrote to memory of 2372 2420 aac83167081b7d228931845c006253f6_JaffaCakes118.exe aac83167081b7d228931845c006253f6_JaffaCakes118.exe PID 2420 wrote to memory of 2372 2420 aac83167081b7d228931845c006253f6_JaffaCakes118.exe aac83167081b7d228931845c006253f6_JaffaCakes118.exe PID 3036 wrote to memory of 2612 3036 lookpack.exe lookpack.exe PID 3036 wrote to memory of 2612 3036 lookpack.exe lookpack.exe PID 3036 wrote to memory of 2612 3036 lookpack.exe lookpack.exe PID 3036 wrote to memory of 2612 3036 lookpack.exe lookpack.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aac83167081b7d228931845c006253f6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aac83167081b7d228931845c006253f6_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\aac83167081b7d228931845c006253f6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aac83167081b7d228931845c006253f6_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2372
-
C:\Windows\SysWOW64\lookpack.exe"C:\Windows\SysWOW64\lookpack.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\lookpack.exe"C:\Windows\SysWOW64\lookpack.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2612