Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 09:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
-
Target
b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe
-
Size
168KB
-
MD5
b7f71db7f2fc9521573a23bbf58aff93
-
SHA1
4cb8185149f7126917b18a668f8c9b2fca87dad1
-
SHA256
ff1537685dcf05b1c30ebf2605a45bea91e9cf7a1aeadefc6dbc707717c2eed1
-
SHA512
7873dad06c3168c540c40458f027f17f5e3278a3a16fba5d9a8f90c40a0b4e1769d4d0b355f90f6a31dd090db5783ece964c3f0b556d3b10ffb93b319032e5ba
-
SSDEEP
3072:NU3EFQStvwaZxP8H1Dt1DO0xFNpYofiSmse/A:fFQcIgx0H5tVx3jqSN7
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
taupefiles.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat taupefiles.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 19 IoCs
Processes:
taupefiles.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-59-4c-ae-15-a3\WpadDecisionReason = "1" taupefiles.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 taupefiles.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" taupefiles.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 taupefiles.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5A8FBB1B-6051-4F89-A926-CC52D9579939}\WpadDecisionTime = d03c23299bc0da01 taupefiles.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5A8FBB1B-6051-4F89-A926-CC52D9579939}\WpadDecision = "0" taupefiles.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-59-4c-ae-15-a3 taupefiles.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5A8FBB1B-6051-4F89-A926-CC52D9579939}\ea-59-4c-ae-15-a3 taupefiles.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-59-4c-ae-15-a3\WpadDecisionTime = d03c23299bc0da01 taupefiles.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings taupefiles.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad taupefiles.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings taupefiles.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5A8FBB1B-6051-4F89-A926-CC52D9579939} taupefiles.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5A8FBB1B-6051-4F89-A926-CC52D9579939}\WpadDecisionReason = "1" taupefiles.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5A8FBB1B-6051-4F89-A926-CC52D9579939}\WpadNetworkName = "Network 3" taupefiles.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-59-4c-ae-15-a3\WpadDecision = "0" taupefiles.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-59-4c-ae-15-a3\WpadDetectedUrl taupefiles.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections taupefiles.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f016c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 taupefiles.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exeb7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exetaupefiles.exetaupefiles.exepid process 2180 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe 2112 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe 2680 taupefiles.exe 2760 taupefiles.exe 2760 taupefiles.exe 2760 taupefiles.exe 2760 taupefiles.exe 2760 taupefiles.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exepid process 2112 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exetaupefiles.exedescription pid process target process PID 2180 wrote to memory of 2112 2180 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe PID 2180 wrote to memory of 2112 2180 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe PID 2180 wrote to memory of 2112 2180 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe PID 2180 wrote to memory of 2112 2180 b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe PID 2680 wrote to memory of 2760 2680 taupefiles.exe taupefiles.exe PID 2680 wrote to memory of 2760 2680 taupefiles.exe taupefiles.exe PID 2680 wrote to memory of 2760 2680 taupefiles.exe taupefiles.exe PID 2680 wrote to memory of 2760 2680 taupefiles.exe taupefiles.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7f71db7f2fc9521573a23bbf58aff93_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2112
-
C:\Windows\SysWOW64\taupefiles.exe"C:\Windows\SysWOW64\taupefiles.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\taupefiles.exe"C:\Windows\SysWOW64\taupefiles.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2760