Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08-07-2024 09:22
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe
-
Size
755KB
-
MD5
2bcd9a26dc2d01db6406970103494390
-
SHA1
37142aba3dc61e34691f3366039aaff8b32c17cc
-
SHA256
205f351bd8239eebb61655a288c53bf537017d4662bdd0a2c0275d0fc89d77c6
-
SHA512
1b80bc7b7720f1bd029d5d0f5b83c53afc93bef5d52f3de08b14c921db7fefe7d95d11a5f0d8dd8152a68da73d939ad0206d860925a10d09542552e2bdc4bbb1
-
SSDEEP
6144:Rpqoa8aLgC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnCZ:RpqgC/2OGAtkCP4cejGSOpRK3CnIim
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe" 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe" 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\r: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\s: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\y: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\g: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\h: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\k: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\n: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\q: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\u: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\v: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\w: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\p: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\t: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\x: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\z: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\a: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\i: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\l: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\m: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\b: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\e: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened (read-only) \??\j: 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2468-0-0x0000000000400000-0x00000000004D5000-memory.dmp autoit_exe behavioral1/files/0x000a0000000122db-36.dat autoit_exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\d:\autorun.inf 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File created \??\f:\autorun.inf 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe File opened for modification F:\\autorun.inf 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.mydreamworld.50webs.com" 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://www.mydreamworld.50webs.com" 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://www.mydreamworld.50webs.com" 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.mydreamworld.50webs.com" 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2068 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 31 PID 2468 wrote to memory of 2068 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 31 PID 2468 wrote to memory of 2068 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 31 PID 2468 wrote to memory of 2068 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 31 PID 2068 wrote to memory of 1044 2068 cmd.exe 33 PID 2068 wrote to memory of 1044 2068 cmd.exe 33 PID 2068 wrote to memory of 1044 2068 cmd.exe 33 PID 2068 wrote to memory of 1044 2068 cmd.exe 33 PID 2468 wrote to memory of 3044 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 34 PID 2468 wrote to memory of 3044 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 34 PID 2468 wrote to memory of 3044 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 34 PID 2468 wrote to memory of 3044 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 34 PID 3044 wrote to memory of 3040 3044 cmd.exe 36 PID 3044 wrote to memory of 3040 3044 cmd.exe 36 PID 3044 wrote to memory of 3040 3044 cmd.exe 36 PID 3044 wrote to memory of 3040 3044 cmd.exe 36 PID 2468 wrote to memory of 2436 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 39 PID 2468 wrote to memory of 2436 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 39 PID 2468 wrote to memory of 2436 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 39 PID 2468 wrote to memory of 2436 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 39 PID 2436 wrote to memory of 1012 2436 cmd.exe 41 PID 2436 wrote to memory of 1012 2436 cmd.exe 41 PID 2436 wrote to memory of 1012 2436 cmd.exe 41 PID 2436 wrote to memory of 1012 2436 cmd.exe 41 PID 2468 wrote to memory of 1780 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 42 PID 2468 wrote to memory of 1780 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 42 PID 2468 wrote to memory of 1780 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 42 PID 2468 wrote to memory of 1780 2468 2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe 42 PID 1780 wrote to memory of 576 1780 cmd.exe 44 PID 1780 wrote to memory of 576 1780 cmd.exe 44 PID 1780 wrote to memory of 576 1780 cmd.exe 44 PID 1780 wrote to memory of 576 1780 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2bcd9a26dc2d01db6406970103494390_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:1044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe3⤵PID:3040
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵PID:1012
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵PID:576
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102B
MD5948c74cd98911b420ff89dac13399bcb
SHA176dfc73518f003953923b1b4f2b973f4bb56a411
SHA25694a1ac3d574425ec8a3cc01675e4d787373d2a190dddd4f8ba507c49ca3fd42a
SHA512b31d82ede9d48e390a50a9dcf5c4c607c62638e8bc56f473250f9a56b7967d5de948abed69bbb2c35eb0112288faa5c438316b06ccbb36d289e93952b30e2ede
-
Filesize
755KB
MD52bcd9a26dc2d01db6406970103494390
SHA137142aba3dc61e34691f3366039aaff8b32c17cc
SHA256205f351bd8239eebb61655a288c53bf537017d4662bdd0a2c0275d0fc89d77c6
SHA5121b80bc7b7720f1bd029d5d0f5b83c53afc93bef5d52f3de08b14c921db7fefe7d95d11a5f0d8dd8152a68da73d939ad0206d860925a10d09542552e2bdc4bbb1