Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 19:58
Static task
static1
Behavioral task
behavioral1
Sample
b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exe
Resource
win7-20240220-en
8 signatures
150 seconds
General
-
Target
b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exe
-
Size
145KB
-
MD5
b9c32274be42fd6ad161ab31f742bc28
-
SHA1
9901f7b53a1a7bf4ede32fa0bef31583553e48bf
-
SHA256
ee0a206415cce60f8b3afb29d8c17f86fe1923cbdf69812be139a3012b2fa24b
-
SHA512
bc7b299144acffa4ae29d173c147a3185d356f260bae6967122d8a56c56016548fcbdd560f06ca4974828ce3afd3d77ce68317aaeab167cf9332477a6e0fd312
-
SSDEEP
3072:uB2Bbs6Raii991vRon8OmfvEywB2xMXYSmuEPgWTrx:uBF6vu91vRohywBODuEPD
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
Processes:
smallviewer.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 smallviewer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 smallviewer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE smallviewer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies smallviewer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
smallviewer.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix smallviewer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" smallviewer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" smallviewer.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
smallviewer.exepid process 3968 smallviewer.exe 3968 smallviewer.exe 3968 smallviewer.exe 3968 smallviewer.exe 3968 smallviewer.exe 3968 smallviewer.exe 3968 smallviewer.exe 3968 smallviewer.exe 3968 smallviewer.exe 3968 smallviewer.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exepid process 2944 b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exesmallviewer.exedescription pid process target process PID 2356 wrote to memory of 2944 2356 b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exe b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exe PID 2356 wrote to memory of 2944 2356 b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exe b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exe PID 2356 wrote to memory of 2944 2356 b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exe b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exe PID 4776 wrote to memory of 3968 4776 smallviewer.exe smallviewer.exe PID 4776 wrote to memory of 3968 4776 smallviewer.exe smallviewer.exe PID 4776 wrote to memory of 3968 4776 smallviewer.exe smallviewer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\b9c32274be42fd6ad161ab31f742bc28_JaffaCakes118.exe--d7ea91772⤵
- Suspicious behavior: RenamesItself
PID:2944
-
C:\Windows\SysWOW64\smallviewer.exe"C:\Windows\SysWOW64\smallviewer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\smallviewer.exe--3dab36ef2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3968