Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-06-2024 08:06
Behavioral task
behavioral1
Sample
114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe
-
Size
528KB
-
MD5
114b0b606e5cf7427184bc390c79ba9c
-
SHA1
206f74ec955d64dfc3dff8d8181e4f2137c4b909
-
SHA256
afb9216450c8dcb6b63ba81c8425d561568f7e20831e12227d6d1fa997e3fae1
-
SHA512
637ff291ec3bf8e12edbe51a6a207e5a280a2f77e2b64a748dd7e7019f2229fdd1e70d12d63a169fde58dbe7544c2296c9fee922f59ab65e5c3ce2dd2aafbb01
-
SSDEEP
12288:aX9mcUsSzxGztt/XLTIbhuqge68EEo+ulEl6HxTO4aO:we1xoLvQbhqe66o+2H84aO
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2988 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2980 ChackPro.exe -
resource yara_rule behavioral1/memory/1732-0-0x0000000000400000-0x0000000000420000-memory.dmp vmprotect behavioral1/files/0x000a000000012286-2.dat vmprotect behavioral1/memory/2980-3-0x0000000000400000-0x0000000000420000-memory.dmp vmprotect behavioral1/memory/1732-11-0x0000000000400000-0x0000000000420000-memory.dmp vmprotect behavioral1/memory/2980-13-0x0000000000400000-0x0000000000420000-memory.dmp vmprotect -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\ChackPro.exe 114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ChackPro.exe 114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat ChackPro.exe -
Modifies data under HKEY_USERS 31 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" ChackPro.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings ChackPro.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ChackPro.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737} ChackPro.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDecisionReason = "1" ChackPro.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ChackPro.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ChackPro.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" ChackPro.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadDecisionTime = 90e2f7ba9fc7da01 ChackPro.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDecisionTime = f06d27dc9fc7da01 ChackPro.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDecisionTime = 108dc5fe9fc7da01 ChackPro.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ChackPro.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadDecisionReason = "1" ChackPro.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadNetworkName = "Network 3" ChackPro.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadDecisionTime = f06d27dc9fc7da01 ChackPro.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" ChackPro.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ChackPro.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\0a-79-9a-29-cf-db ChackPro.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDecision = "0" ChackPro.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDetectedUrl ChackPro.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad ChackPro.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ChackPro.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadDecision = "0" ChackPro.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ChackPro.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadDecisionTime = 108dc5fe9fc7da01 ChackPro.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ChackPro.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ChackPro.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDecisionTime = 90e2f7ba9fc7da01 ChackPro.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db ChackPro.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ChackPro.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ChackPro.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1732 114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe Token: SeDebugPrivilege 2980 ChackPro.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2988 1732 114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe 29 PID 1732 wrote to memory of 2988 1732 114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe 29 PID 1732 wrote to memory of 2988 1732 114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe 29 PID 1732 wrote to memory of 2988 1732 114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\_uninsep.bat2⤵
- Deletes itself
PID:2988
-
-
C:\Windows\SysWOW64\ChackPro.exeC:\Windows\SysWOW64\ChackPro.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2980
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD541b09be07764ced7d6de33de45b5bcae
SHA11c7458d40156b10929a7e2edb2fa6fa25c71365d
SHA256f7072adedb23f30437e77d19b4ea5eb2c4e4f24c7601c4b2366424b9e30479bb
SHA5125e1e594e09bd2c551fb3d00d5464619107a002228a19535bbfbf73bb713d774f6198ec0521dd5fcc50a33901611e77f0e21f70bb676e986b8606fcf617050fe6
-
Filesize
528KB
MD5114b0b606e5cf7427184bc390c79ba9c
SHA1206f74ec955d64dfc3dff8d8181e4f2137c4b909
SHA256afb9216450c8dcb6b63ba81c8425d561568f7e20831e12227d6d1fa997e3fae1
SHA512637ff291ec3bf8e12edbe51a6a207e5a280a2f77e2b64a748dd7e7019f2229fdd1e70d12d63a169fde58dbe7544c2296c9fee922f59ab65e5c3ce2dd2aafbb01