Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 10:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe
Resource
win7-20240419-en
7 signatures
150 seconds
General
-
Target
b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe
-
Size
136KB
-
MD5
b82b6b7a48bf4e049cb4c338b18921eb
-
SHA1
41b9ee9deac56d3ad5ca11ca2db408ea67567b93
-
SHA256
c7c64507d9df7bc28d251132cb309b54b86e939d5e2e21894e0573e9a1ec9ddc
-
SHA512
ed02bf9522a1ff367a68103020242c623520809f168fa2d46202f26e19022bfc5f291cda08dc030e57ae5d7aa7fb356ce71ca74cbf506f97e9fbcb0e60cc6d5b
-
SSDEEP
1536:ylQ1YOZpCGwKrKNDiVTzHvHTmaNBzkRNwmX2IlpI0cuF/2:h1YMpCGw5pqSaNBzrox2
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
defragshared.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat defragshared.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 25 IoCs
Processes:
defragshared.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-98-e5-d9-e3-d0 defragshared.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-98-e5-d9-e3-d0\WpadDecisionTime = b0cc047ba2c0da01 defragshared.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections defragshared.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix defragshared.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 defragshared.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-98-e5-d9-e3-d0\WpadDecisionReason = "1" defragshared.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings defragshared.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B49A160-E7F5-4B4C-BB1D-8E68CCAB25B1}\WpadDecisionTime = 700c0e27a2c0da01 defragshared.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" defragshared.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B49A160-E7F5-4B4C-BB1D-8E68CCAB25B1}\WpadNetworkName = "Network 3" defragshared.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-98-e5-d9-e3-d0\WpadDecisionTime = 700c0e27a2c0da01 defragshared.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-98-e5-d9-e3-d0\WpadDecision = "0" defragshared.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B49A160-E7F5-4B4C-BB1D-8E68CCAB25B1} defragshared.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B49A160-E7F5-4B4C-BB1D-8E68CCAB25B1}\f6-98-e5-d9-e3-d0 defragshared.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B49A160-E7F5-4B4C-BB1D-8E68CCAB25B1}\WpadDecision = "0" defragshared.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" defragshared.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" defragshared.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B49A160-E7F5-4B4C-BB1D-8E68CCAB25B1}\WpadDecisionReason = "1" defragshared.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 defragshared.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad defragshared.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 defragshared.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-98-e5-d9-e3-d0\WpadDetectedUrl defragshared.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B49A160-E7F5-4B4C-BB1D-8E68CCAB25B1}\WpadDecisionTime = b0cc047ba2c0da01 defragshared.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings defragshared.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 defragshared.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exeb82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exedefragshared.exedefragshared.exepid process 2236 b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe 2072 b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe 2676 defragshared.exe 2756 defragshared.exe 2756 defragshared.exe 2756 defragshared.exe 2756 defragshared.exe 2756 defragshared.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exepid process 2072 b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exedefragshared.exedescription pid process target process PID 2236 wrote to memory of 2072 2236 b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe PID 2236 wrote to memory of 2072 2236 b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe PID 2236 wrote to memory of 2072 2236 b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe PID 2236 wrote to memory of 2072 2236 b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe PID 2676 wrote to memory of 2756 2676 defragshared.exe defragshared.exe PID 2676 wrote to memory of 2756 2676 defragshared.exe defragshared.exe PID 2676 wrote to memory of 2756 2676 defragshared.exe defragshared.exe PID 2676 wrote to memory of 2756 2676 defragshared.exe defragshared.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2072
-
C:\Windows\SysWOW64\defragshared.exe"C:\Windows\SysWOW64\defragshared.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\defragshared.exe"C:\Windows\SysWOW64\defragshared.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2756