Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 04:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe
-
Size
21KB
-
MD5
248fbc673e005c85bf73aa37e12abaf4
-
SHA1
bb26c7af7516255a41e9a1a82d4508618594d3b8
-
SHA256
5a1d4b4d44fd3e11d5e7ccc1b0fc7625d7e8c94747b4608700d95852441a6350
-
SHA512
b32c2fcd7283141c83e91ac20e011087c36622ea1b18ee025628b1b14c327f84c01cb2c8fa980d1827548aaae7adff607d14c5ea7c5b56ba89eb0f7c07804cae
-
SSDEEP
384:IL+IYQRSvFc7B+zP4ckFAjaUZlNrGFecgnF/9F5ZnqGcIyiYQA:11kB+zPgiaUPxUgF/9F/GIylB
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2744 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\ca99d57.drv 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\3474A8C2.cfg 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\3474A8C2.dll 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID\{3474A8C2-BEF9-46C8-983A-A26A0030EC30}\InprocServer32 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3474A8C2-BEF9-46C8-983A-A26A0030EC30} 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3474A8C2-BEF9-46C8-983A-A26A0030EC30}\InprocServer32 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3474A8C2-BEF9-46C8-983A-A26A0030EC30}\InprocServer32\ = "3474A8C2.dll" 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3474A8C2-BEF9-46C8-983A-A26A0030EC30}\InprocServer32\ThreadingModel = "Apartment" 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 476 Process not Found 476 Process not Found -
Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2744 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe 28 PID 2172 wrote to memory of 2744 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe 28 PID 2172 wrote to memory of 2744 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe 28 PID 2172 wrote to memory of 2744 2172 248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\248fbc673e005c85bf73aa37e12abaf4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\248FBC~1.EXE >> NUL2⤵
- Deletes itself
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD52abaf1861113e0dd32eda9f5727bc887
SHA1bc857113fa4a974a3b4ac24ec7be7fa6053b3c45
SHA2567f228945937b18e790cd14f7d7f74705b4d90fdd9960264d963fa86f5ff069a5
SHA5121e468ea1141de361927e85ffb95260b12a9fea726e5a1b8014f419077acf46ba8341a2e6e2ebad93c6f7b5253983088ff956dcd2f9ce82da3d382b21c133c567