Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11-07-2024 14:34
Static task
static1
Behavioral task
behavioral1
Sample
3986fe8863635ff9127f820492d39203_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3986fe8863635ff9127f820492d39203_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3986fe8863635ff9127f820492d39203_JaffaCakes118.exe
-
Size
387KB
-
MD5
3986fe8863635ff9127f820492d39203
-
SHA1
8cc9a140a377c67394030fe23f0fa599eb42a156
-
SHA256
d690938d9f658b2eee47dad5223f18fe3df173174589828bb52179d34a154437
-
SHA512
abb8858a41fd06634a41d5b6a8e99da08be68b08eb8bbf91998350de7e314505ca2e2469f185c71503998ad69fc0133d5bd59236416a2d98b08c3ac6f8bedc23
-
SSDEEP
6144:3jOj8iZWIMWWNUar3lc7UCvFzBNzGZwUMDBwCEwZF0PcZfzUNlGq4do2:3uZWBFjlc7UCvBBN6ZwUMDCvrQzU/3I
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3032 iM06509AeBnN06509.exe -
Executes dropped EXE 1 IoCs
pid Process 3032 iM06509AeBnN06509.exe -
Loads dropped DLL 2 IoCs
pid Process 1824 3986fe8863635ff9127f820492d39203_JaffaCakes118.exe 1824 3986fe8863635ff9127f820492d39203_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1824-1-0x0000000000400000-0x00000000004C0000-memory.dmp upx behavioral1/memory/1824-17-0x0000000000400000-0x00000000004C0000-memory.dmp upx behavioral1/memory/3032-25-0x0000000000400000-0x00000000004C0000-memory.dmp upx behavioral1/memory/3032-29-0x0000000000400000-0x00000000004C0000-memory.dmp upx behavioral1/memory/3032-38-0x0000000000400000-0x00000000004C0000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\iM06509AeBnN06509 = "C:\\ProgramData\\iM06509AeBnN06509\\iM06509AeBnN06509.exe" iM06509AeBnN06509.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iM06509AeBnN06509.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1824 3986fe8863635ff9127f820492d39203_JaffaCakes118.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1824 3986fe8863635ff9127f820492d39203_JaffaCakes118.exe Token: SeDebugPrivilege 3032 iM06509AeBnN06509.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3032 iM06509AeBnN06509.exe 3032 iM06509AeBnN06509.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1824 wrote to memory of 3032 1824 3986fe8863635ff9127f820492d39203_JaffaCakes118.exe 30 PID 1824 wrote to memory of 3032 1824 3986fe8863635ff9127f820492d39203_JaffaCakes118.exe 30 PID 1824 wrote to memory of 3032 1824 3986fe8863635ff9127f820492d39203_JaffaCakes118.exe 30 PID 1824 wrote to memory of 3032 1824 3986fe8863635ff9127f820492d39203_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3986fe8863635ff9127f820492d39203_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3986fe8863635ff9127f820492d39203_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\ProgramData\iM06509AeBnN06509\iM06509AeBnN06509.exe"C:\ProgramData\iM06509AeBnN06509\iM06509AeBnN06509.exe" "C:\Users\Admin\AppData\Local\Temp\3986fe8863635ff9127f820492d39203_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD54052002b0cfe784865ab01a5d204aaca
SHA1476f7f1af4e5609022f2e33726d9ac007a1a781b
SHA256e5560b8fad3a88d34f581f56990ff22f4c5dfff9512a4c1e427578f242d3696f
SHA5128a2f3556ef9903d6c7ec575682ae6d791ec4026c47eacb115f1cc9574f558ef7f3fb58d95654cfa5d80e7ed48dd34f88bb90caa2913a3319f1822b8b89f7f664
-
Filesize
387KB
MD5077b57655dbe3cd151ae1a207fdca09c
SHA1fed82ae5e189f03912e3559aeadb3e3588725e59
SHA2566d2a36a4692009c821a2accbacb5758a00aee1036a80760789b07a8cbd0a0e7f
SHA51284c13ada6f9443149eb4894963d0de46bcb1e982645e663a0c3e30651998fa7ecc58f8b2811d7876a25dd6c3affb3e16a83b2bb51d3a8fd3be8b620e5456b41d