Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
19/06/2024, 21:26
Static task
static1
Behavioral task
behavioral1
Sample
0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe
-
Size
15KB
-
MD5
0092a905707b67411fa7410e1928e3bd
-
SHA1
2a6124ccc212c3dff546a0888766a471849d0f74
-
SHA256
2fd730ed3b66cbb49655ca49e1718a3caa147572ba824dc322390ed2ee626009
-
SHA512
81f77ad014de344fa1f09e869131f24aa4e1860487f0ad74bf13ba96ea9675a48fa5d6ef721c898906eff9e5dea23fe7c5978098d807cf3796321f968bf747e0
-
SSDEEP
384:3Hi1PKlhMWPyTWz1H2Il9Ivj9djueO+gCW54p:3i43aKzX7Wd5O+aqp
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\HBKernel32.sys 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Deletes itself 1 IoCs
pid Process 2984 rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 1584 System.exe -
Loads dropped DLL 7 IoCs
pid Process 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe 2984 rundll32.exe 2984 rundll32.exe 2984 rundll32.exe 2984 rundll32.exe 1584 System.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HBService32 = "System.exe" 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HBService32 = "System.exe" System.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\HBSO2.dll 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe File created C:\Windows\SysWOW64\System.exe 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 484 Process not Found 484 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1584 System.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1844 wrote to memory of 1584 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe 28 PID 1844 wrote to memory of 1584 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe 28 PID 1844 wrote to memory of 1584 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe 28 PID 1844 wrote to memory of 1584 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe 28 PID 1844 wrote to memory of 2984 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe 29 PID 1844 wrote to memory of 2984 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe 29 PID 1844 wrote to memory of 2984 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe 29 PID 1844 wrote to memory of 2984 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe 29 PID 1844 wrote to memory of 2984 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe 29 PID 1844 wrote to memory of 2984 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe 29 PID 1844 wrote to memory of 2984 1844 0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\System.exeC:\Windows\system32\System.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1584
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\HBSelfDel.dll,MagicDelete C:\Users\Admin\AppData\Local\Temp\0092a905707b67411fa7410e1928e3bd_JaffaCakes118.exe2⤵
- Deletes itself
- Loads dropped DLL
PID:2984
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5a5735936b44f5bb2bcc31b2ea6143e18
SHA1768d127d012961e1b11a96f3f450ca94d8cef86a
SHA256c67a360b1a243b198bae9812349099c814d58d9323d9e2c9f0df9d9392c44b29
SHA512d63538ea1e2971e7ca3a437d48054dea39dd560683d268482b70e6e58f8465c9f2ed9a4e27b894078acf1943c4e7c3bf96acf3a83a65bda8a34b12cf82ef98be
-
Filesize
3KB
MD516fddb8ac4d11916c6920260593ddded
SHA1058ef57237f2898e77a3e65b8b3ded1371a831cd
SHA2561500f761104965c6ba4d4e8cdc3524347f6b189fc95178569a37a1fa870a2eae
SHA51241cfb9ff0455477b0025cfad30c99fe030ba49fcf836d959af8893cdd363429feccac3d9322986ae2b45201367b88ccae42dccd4bb36251a70644ea2ea222243
-
Filesize
5KB
MD5dd4ab823aedf142ce4adfacbaa152b86
SHA150d4425016bcfafc212eccf7680b3378145e3825
SHA25632aef6a43eba50e5d86d285741f05dc9fc7620a8edac8ae6f87da59621ddd753
SHA512c509e3cb08804c395b2fc659ede09a44aaf44129e190cd9a38f86353cbd2b2674b73909d2d9dba5d6c562bcc950e8e90a6c4699d95eb925d0c53d519d1ae5b47