Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 10:06
Static task
static1
Behavioral task
behavioral1
Sample
3447b89187133d1975648f4087b3300e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3447b89187133d1975648f4087b3300e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3447b89187133d1975648f4087b3300e_JaffaCakes118.exe
-
Size
171KB
-
MD5
3447b89187133d1975648f4087b3300e
-
SHA1
22598110c0b09905f69a22fce50ff2441acadf83
-
SHA256
7506af8f220c1237b0c57375820f382bc3cba14c5a313ae568b066e91ddd2c9b
-
SHA512
8b5cfd8601cea011c6b09013e12c692500cfc768a24a3ffb0998fa3713f5a40e218ac5a0930eabf3eccabd470222f22e170c5e94c7f08eb00a6f7af842fa5ace
-
SSDEEP
1536:X9wTi1AJmKESNJJHTvZegHLC/Vy5P7nRK8MG68Liik4TFjhMc2T7OsrUqt+cf8y3:NaNmy7njLiaxec2HdrUqt+cf1iesW1
Malware Config
Extracted
tofsee
64.20.54.234
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2748 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
dgabdur.exedgabdur.exepid process 2120 dgabdur.exe 2596 dgabdur.exe -
Loads dropped DLL 3 IoCs
Processes:
3447b89187133d1975648f4087b3300e_JaffaCakes118.exedgabdur.exepid process 2868 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe 2868 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe 2120 dgabdur.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3447b89187133d1975648f4087b3300e_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\dgabdur.exe\" /r" 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
3447b89187133d1975648f4087b3300e_JaffaCakes118.exedgabdur.exedgabdur.exedescription pid process target process PID 2840 set thread context of 2868 2840 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe PID 2120 set thread context of 2596 2120 dgabdur.exe dgabdur.exe PID 2596 set thread context of 2080 2596 dgabdur.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 1 IoCs
Processes:
3447b89187133d1975648f4087b3300e_JaffaCakes118.exepid process 2840 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
3447b89187133d1975648f4087b3300e_JaffaCakes118.exe3447b89187133d1975648f4087b3300e_JaffaCakes118.exedgabdur.exedgabdur.exedescription pid process target process PID 2840 wrote to memory of 2868 2840 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe PID 2840 wrote to memory of 2868 2840 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe PID 2840 wrote to memory of 2868 2840 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe PID 2840 wrote to memory of 2868 2840 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe PID 2840 wrote to memory of 2868 2840 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe PID 2840 wrote to memory of 2868 2840 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe PID 2840 wrote to memory of 2868 2840 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe PID 2840 wrote to memory of 2868 2840 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe PID 2840 wrote to memory of 2868 2840 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe PID 2868 wrote to memory of 2120 2868 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe dgabdur.exe PID 2868 wrote to memory of 2120 2868 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe dgabdur.exe PID 2868 wrote to memory of 2120 2868 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe dgabdur.exe PID 2868 wrote to memory of 2120 2868 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe dgabdur.exe PID 2868 wrote to memory of 2748 2868 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe cmd.exe PID 2868 wrote to memory of 2748 2868 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe cmd.exe PID 2868 wrote to memory of 2748 2868 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe cmd.exe PID 2868 wrote to memory of 2748 2868 3447b89187133d1975648f4087b3300e_JaffaCakes118.exe cmd.exe PID 2120 wrote to memory of 2596 2120 dgabdur.exe dgabdur.exe PID 2120 wrote to memory of 2596 2120 dgabdur.exe dgabdur.exe PID 2120 wrote to memory of 2596 2120 dgabdur.exe dgabdur.exe PID 2120 wrote to memory of 2596 2120 dgabdur.exe dgabdur.exe PID 2120 wrote to memory of 2596 2120 dgabdur.exe dgabdur.exe PID 2120 wrote to memory of 2596 2120 dgabdur.exe dgabdur.exe PID 2120 wrote to memory of 2596 2120 dgabdur.exe dgabdur.exe PID 2120 wrote to memory of 2596 2120 dgabdur.exe dgabdur.exe PID 2120 wrote to memory of 2596 2120 dgabdur.exe dgabdur.exe PID 2596 wrote to memory of 2080 2596 dgabdur.exe svchost.exe PID 2596 wrote to memory of 2080 2596 dgabdur.exe svchost.exe PID 2596 wrote to memory of 2080 2596 dgabdur.exe svchost.exe PID 2596 wrote to memory of 2080 2596 dgabdur.exe svchost.exe PID 2596 wrote to memory of 2080 2596 dgabdur.exe svchost.exe PID 2596 wrote to memory of 2080 2596 dgabdur.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3447b89187133d1975648f4087b3300e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3447b89187133d1975648f4087b3300e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\3447b89187133d1975648f4087b3300e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3447b89187133d1975648f4087b3300e_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\dgabdur.exe"C:\Users\Admin\dgabdur.exe" /r3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\dgabdur.exe"C:\Users\Admin\dgabdur.exe" /r4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵PID:2080
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\8656.bat" "3⤵
- Deletes itself
PID:2748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8656.batFilesize
117B
MD58500dabcf93e016291f872501f853441
SHA10646e18e141cf78c72be71f1a1e7866b2b342952
SHA256b71a8e9576974d9caee9803e643a2bae66964cedecd4efef811a2afc4f5833f2
SHA512852777baa39b91df4d2764467f2c6e7f2bd797a1fdaa3b616f9da0d51d7c353f71c1eae2b34a95a77810c39adc3085d20555799f4dece57a0daa944cf916d9bc
-
\Users\Admin\dgabdur.exeFilesize
171KB
MD53447b89187133d1975648f4087b3300e
SHA122598110c0b09905f69a22fce50ff2441acadf83
SHA2567506af8f220c1237b0c57375820f382bc3cba14c5a313ae568b066e91ddd2c9b
SHA5128b5cfd8601cea011c6b09013e12c692500cfc768a24a3ffb0998fa3713f5a40e218ac5a0930eabf3eccabd470222f22e170c5e94c7f08eb00a6f7af842fa5ace
-
memory/2080-58-0x0000000000080000-0x0000000000090000-memory.dmpFilesize
64KB
-
memory/2080-66-0x0000000000080000-0x0000000000090000-memory.dmpFilesize
64KB
-
memory/2080-65-0x0000000000080000-0x0000000000090000-memory.dmpFilesize
64KB
-
memory/2080-64-0x0000000000080000-0x0000000000090000-memory.dmpFilesize
64KB
-
memory/2080-63-0x0000000000080000-0x0000000000090000-memory.dmpFilesize
64KB
-
memory/2080-60-0x0000000000080000-0x0000000000090000-memory.dmpFilesize
64KB
-
memory/2080-54-0x0000000000080000-0x0000000000090000-memory.dmpFilesize
64KB
-
memory/2080-52-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2596-50-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2596-49-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2868-21-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2868-10-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2868-31-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2868-4-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2868-32-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2868-0-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2868-8-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2868-12-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2868-6-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB