Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 23:02
Static task
static1
Behavioral task
behavioral1
Sample
0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe
-
Size
13KB
-
MD5
0fd9de7ade782e98932527224de8190d
-
SHA1
77a3599c64b13b7848d876f431e6ed438d5f1eeb
-
SHA256
b658e2e642ebcc72efdc36341a604252703231db7a59ed85463eac8fb8be34f7
-
SHA512
304176f5dda65b7c8cf9364b61399cd0902edd22440ab40584c33658bcb24969b6d7d612fe209811a5ca2658055458d29d33350eff3e5962a16a3f6f436aaa3b
-
SSDEEP
384:DxmI6AoJtteqexodGcuudFOvmRr4qHB+v:9mLtteVxrNud8vm9nHB+v
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\cliconfgzx.dll = "{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}" 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 2984 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 2204 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\cliconfgzx.tmp 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cliconfgzx.tmp 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cliconfgzx.nls 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07} 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32\ = "C:\\Windows\\SysWow64\\cliconfgzx.dll" 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32\ThreadingModel = "Apartment" 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2204 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2204 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe 2204 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe 2204 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2984 2204 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe 28 PID 2204 wrote to memory of 2984 2204 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe 28 PID 2204 wrote to memory of 2984 2204 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe 28 PID 2204 wrote to memory of 2984 2204 0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\8640.tmp.bat2⤵
- Deletes itself
PID:2984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207B
MD502c560d362e0721e992f2c9dfad1a007
SHA199038dff5a34c6e53d13c3bd7aca5b01bcfcee99
SHA256de08ec400913eb50a4522bec9a399c2fa0a530304eafc23b36b77aed623ffc49
SHA512d384927c35bb1c70f11b736c53204c424a515cf06291cf0468da8c65f906d1e16572a68afb273c78954ae340a4b3b2b57a219df0da96e4cecd0a0667fd6cae3f
-
Filesize
677KB
MD5343f345a18dee73fc5d43a53e83e25c6
SHA101e8fbd97a2f68377cae7bf159c921b1a8388ce3
SHA2566419af112c17edc95102675710543646d6daf2ffba4d7cf77dd36512253fd4ba
SHA51233e8b1895b49f8d11c0cb6beb01f45d7aab5ab2f4345ec709b86134451219d2cdfa30771b9d5ec1b16147d688304919d37dd30e89b2bf3481ab9e83149fd15b4