Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:12
Behavioral task
behavioral1
Sample
366662fe013e758469c281abce27a0fa_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
366662fe013e758469c281abce27a0fa_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
366662fe013e758469c281abce27a0fa
-
SHA1
80339df6c307c8f0a05d83fe82ff7cdc62bb9474
-
SHA256
cd612bae744f9a64db0732fca868edcf5478ee5b308794317c5f3a85e8936135
-
SHA512
60ab8bb62ddae56253697830abed9243ac72f8f030e22f49227963c7c93217928ca8be40e2f2aa4a93e8097c533703b904110d4c4acf7139030c3bfbcb8e758e
-
SSDEEP
24576:EMbBQEF+9cMF8EfVxsFM3wLgr7dIyk38SZ+XrgAeorXLJY:EMq9Vrsi3wkr7+yk3H+bgnorXVY
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2720 cmd.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
366662fe013e758469c281abce27a0fa_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Wine 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/2524-0-0x0000000000400000-0x0000000000653000-memory.dmp themida behavioral1/memory/2524-10-0x0000000000400000-0x0000000000653000-memory.dmp themida -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2524-10-0x0000000000400000-0x0000000000653000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
366662fe013e758469c281abce27a0fa_JaffaCakes118.exepid process 2524 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
Processes:
366662fe013e758469c281abce27a0fa_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
366662fe013e758469c281abce27a0fa_JaffaCakes118.exepid process 2524 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
366662fe013e758469c281abce27a0fa_JaffaCakes118.exepid process 2524 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe 2524 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe 2524 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
366662fe013e758469c281abce27a0fa_JaffaCakes118.exepid process 2524 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe 2524 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe 2524 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
366662fe013e758469c281abce27a0fa_JaffaCakes118.exedescription pid process target process PID 2524 wrote to memory of 2720 2524 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe cmd.exe PID 2524 wrote to memory of 2720 2524 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe cmd.exe PID 2524 wrote to memory of 2720 2524 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe cmd.exe PID 2524 wrote to memory of 2720 2524 366662fe013e758469c281abce27a0fa_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\366662fe013e758469c281abce27a0fa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\366662fe013e758469c281abce27a0fa_JaffaCakes118.exe"1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\remove.bat2⤵
- Deletes itself
PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258B
MD568705180a451b3b07f40c5561b0244b6
SHA1e3c3925718589eeeb44d4641ded8e2e712255563
SHA2566e9af1831db46bb373e3fd4d4d8979ca11b50485125432f6b78a6775661cff07
SHA512cbf53f25025fd3cc5c841167542dd2f6a52d37fe9aa1e5aa21c4d5c1cc2741bceb549591092ce6fa273f9c21f431398c4be71a8c172678d0cb9550a6148c3d45