Analysis
-
max time kernel
130s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 21:33
Static task
static1
Behavioral task
behavioral1
Sample
b0321e5472b660e88475150a08046f96_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
b0321e5472b660e88475150a08046f96_JaffaCakes118.exe
-
Size
136KB
-
MD5
b0321e5472b660e88475150a08046f96
-
SHA1
908ad051057181f5dc7ec9612566d1f91df6f8c9
-
SHA256
4351997cac5515c936f357f7d0954e54774c62ecdb46f959ca6af1245a711f0e
-
SHA512
a72cc235229180285ae4f1697cb53d24a55cb5bcbae697e7ae87206623c8e00b143fcae60cd2f48c23c4b8c6342d6e3979a88c3a8b53ae912eb3e1fcf6812339
-
SSDEEP
1536:hgtaukjjOHZpVga9BJbLQheoMEwgiP8Rp+StQRex6+1fJKHtYmXCa:hgyjSVgaKcoTwR0LaRe8+1fJKH26
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
bmlreports.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat bmlreports.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 22 IoCs
Processes:
bmlreports.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0049000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bmlreports.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F8B593D4-AC9C-4869-B34E-CD72B9B36F58}\WpadDecisionTime = c0f5cac76bbfda01 bmlreports.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F8B593D4-AC9C-4869-B34E-CD72B9B36F58}\WpadDecision = "0" bmlreports.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F8B593D4-AC9C-4869-B34E-CD72B9B36F58}\WpadNetworkName = "Network 3" bmlreports.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-1f-df-43-f7-d9\WpadDecisionTime = c0f5cac76bbfda01 bmlreports.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings bmlreports.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bmlreports.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" bmlreports.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-1f-df-43-f7-d9\WpadDetectedUrl bmlreports.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F8B593D4-AC9C-4869-B34E-CD72B9B36F58}\WpadDecisionTime = 60ff5d036cbfda01 bmlreports.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-1f-df-43-f7-d9\WpadDecisionTime = 60ff5d036cbfda01 bmlreports.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F8B593D4-AC9C-4869-B34E-CD72B9B36F58}\aa-1f-df-43-f7-d9 bmlreports.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-1f-df-43-f7-d9\WpadDecisionReason = "1" bmlreports.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-1f-df-43-f7-d9\WpadDecision = "0" bmlreports.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F8B593D4-AC9C-4869-B34E-CD72B9B36F58}\WpadDecisionReason = "1" bmlreports.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-1f-df-43-f7-d9 bmlreports.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0049000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bmlreports.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections bmlreports.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad bmlreports.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F8B593D4-AC9C-4869-B34E-CD72B9B36F58} bmlreports.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings bmlreports.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bmlreports.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
b0321e5472b660e88475150a08046f96_JaffaCakes118.exeb0321e5472b660e88475150a08046f96_JaffaCakes118.exebmlreports.exebmlreports.exepid process 2364 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe 2208 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe 2640 bmlreports.exe 2972 bmlreports.exe 2972 bmlreports.exe 2972 bmlreports.exe 2972 bmlreports.exe 2972 bmlreports.exe 2972 bmlreports.exe 2972 bmlreports.exe 2972 bmlreports.exe 2972 bmlreports.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
b0321e5472b660e88475150a08046f96_JaffaCakes118.exepid process 2208 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b0321e5472b660e88475150a08046f96_JaffaCakes118.exebmlreports.exedescription pid process target process PID 2364 wrote to memory of 2208 2364 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe b0321e5472b660e88475150a08046f96_JaffaCakes118.exe PID 2364 wrote to memory of 2208 2364 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe b0321e5472b660e88475150a08046f96_JaffaCakes118.exe PID 2364 wrote to memory of 2208 2364 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe b0321e5472b660e88475150a08046f96_JaffaCakes118.exe PID 2364 wrote to memory of 2208 2364 b0321e5472b660e88475150a08046f96_JaffaCakes118.exe b0321e5472b660e88475150a08046f96_JaffaCakes118.exe PID 2640 wrote to memory of 2972 2640 bmlreports.exe bmlreports.exe PID 2640 wrote to memory of 2972 2640 bmlreports.exe bmlreports.exe PID 2640 wrote to memory of 2972 2640 bmlreports.exe bmlreports.exe PID 2640 wrote to memory of 2972 2640 bmlreports.exe bmlreports.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0321e5472b660e88475150a08046f96_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b0321e5472b660e88475150a08046f96_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b0321e5472b660e88475150a08046f96_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b0321e5472b660e88475150a08046f96_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\bmlreports.exe"C:\Windows\SysWOW64\bmlreports.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\bmlreports.exe"C:\Windows\SysWOW64\bmlreports.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2208-24-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2208-11-0x0000000000350000-0x0000000000368000-memory.dmpFilesize
96KB
-
memory/2208-10-0x00000000002F0000-0x0000000000307000-memory.dmpFilesize
92KB
-
memory/2208-4-0x0000000000330000-0x0000000000347000-memory.dmpFilesize
92KB
-
memory/2208-25-0x00000000002F0000-0x0000000000307000-memory.dmpFilesize
92KB
-
memory/2364-8-0x0000000001B60000-0x0000000001B77000-memory.dmpFilesize
92KB
-
memory/2364-0-0x0000000001B80000-0x0000000001B97000-memory.dmpFilesize
92KB
-
memory/2364-9-0x0000000001BA0000-0x0000000001BB8000-memory.dmpFilesize
96KB
-
memory/2640-12-0x00000000005C0000-0x00000000005D7000-memory.dmpFilesize
92KB
-
memory/2640-16-0x0000000000330000-0x0000000000347000-memory.dmpFilesize
92KB
-
memory/2640-17-0x0000000000880000-0x0000000000898000-memory.dmpFilesize
96KB
-
memory/2972-18-0x00000000002B0000-0x00000000002C7000-memory.dmpFilesize
92KB
-
memory/2972-23-0x00000000002D0000-0x00000000002E8000-memory.dmpFilesize
96KB
-
memory/2972-22-0x0000000000290000-0x00000000002A7000-memory.dmpFilesize
92KB
-
memory/2972-26-0x0000000000290000-0x00000000002A7000-memory.dmpFilesize
92KB