Analysis
-
max time kernel
146s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11-07-2024 19:31
Static task
static1
Behavioral task
behavioral1
Sample
3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe
-
Size
399KB
-
MD5
3a73c9c4a1e78e49f8b0649de5f5f8c5
-
SHA1
7582cffb3f24fb6a15a99a67986d980d90f52d8f
-
SHA256
2152a980e864940db36cde90c649f66e7c2da15790e97703a28cb378fb7b5ca6
-
SHA512
1d561abb979d5d0d0e1ccc3b2932842dc0adace7aacc828b6f09531b63b4b2869b11eeb92e3f861fb2e04822be6cbff49e416ea00dc458fa37f2ffc51ee16af9
-
SSDEEP
6144:UhtI9ERQ+3HwOGy3cyiyQ6AnXrUOGXc97ylrpcQwiCdl5WBI/w9nBrj4+T0:/ESoGFaQ68XrnGXsOluQndBI/w9Bw+Q
Malware Config
Extracted
formbook
4.1
gefn
noticiastdf.com
coachc.today
chokeonwords.com
7xqfkg.com
shsnywhs159.com
padison8t.com
biglifeshirts.com
smartlifeplus1.net
shein.shoes
jiankong1234.com
yuedahs.com
gold-dust.xyz
gladway.net
titanpestandwildlife.com
hivetire.net
onycostopsale.com
lovesglamshop.store
theuapmusic.com
ohiomakeupgirls.com
80cq926.top
bapakkokdua.com
theaeromfg.com
dnf21.asia
skyvaultonline.com
bhavyafoodservices.com
mango-consulting.com
happy-pets.xyz
infopiek.com
sebasfernandezart.com
dayinsiemreap.com
379591.com
accom2012.com
cerulevar.com
recklessdynamic.com
featuredcups.xyz
dancreo.online
traction.legal
wuqin66.com
dangkytrasauviettel360.club
puffweet.com
healthkey.store
strealty.online
taurusbeam.com
flp.onl
buytigress-alert.com
cookiesandkremebarry.com
akatlarlionsleo.com
seams-unusual.com
dongyedl.com
jidouda.xyz
linixup.com
foldanaresidence.com
vanetys-presquiles.com
chainqwe-top.xyz
417241.com
liuhaibing.online
networkporkwd.xyz
billzmerchandise.com
milartex.com
letitgrowtnpasumo5.xyz
bikesbourbonandbrass.com
xiaofaxiao.com
xhdoctor.com
octacoreserver.com
comercialocaranza.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2556-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1384-23-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exeRegSvcs.exesvchost.exedescription pid process target process PID 2896 set thread context of 2556 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe RegSvcs.exe PID 2556 set thread context of 1224 2556 RegSvcs.exe Explorer.EXE PID 1384 set thread context of 1224 1384 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exeRegSvcs.exepowershell.exesvchost.exepid process 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe 2556 RegSvcs.exe 2556 RegSvcs.exe 2868 powershell.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe 1384 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exesvchost.exepid process 2556 RegSvcs.exe 2556 RegSvcs.exe 2556 RegSvcs.exe 1384 svchost.exe 1384 svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exeRegSvcs.exepowershell.exesvchost.exedescription pid process Token: SeDebugPrivilege 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe Token: SeDebugPrivilege 2556 RegSvcs.exe Token: SeDebugPrivilege 2868 powershell.exe Token: SeDebugPrivilege 1384 svchost.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exeExplorer.EXEsvchost.exedescription pid process target process PID 2896 wrote to memory of 2868 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe powershell.exe PID 2896 wrote to memory of 2868 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe powershell.exe PID 2896 wrote to memory of 2868 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe powershell.exe PID 2896 wrote to memory of 2868 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe powershell.exe PID 2896 wrote to memory of 2880 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe schtasks.exe PID 2896 wrote to memory of 2880 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe schtasks.exe PID 2896 wrote to memory of 2880 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe schtasks.exe PID 2896 wrote to memory of 2880 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe schtasks.exe PID 2896 wrote to memory of 2556 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe RegSvcs.exe PID 2896 wrote to memory of 2556 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe RegSvcs.exe PID 2896 wrote to memory of 2556 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe RegSvcs.exe PID 2896 wrote to memory of 2556 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe RegSvcs.exe PID 2896 wrote to memory of 2556 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe RegSvcs.exe PID 2896 wrote to memory of 2556 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe RegSvcs.exe PID 2896 wrote to memory of 2556 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe RegSvcs.exe PID 2896 wrote to memory of 2556 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe RegSvcs.exe PID 2896 wrote to memory of 2556 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe RegSvcs.exe PID 2896 wrote to memory of 2556 2896 3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe RegSvcs.exe PID 1224 wrote to memory of 1384 1224 Explorer.EXE svchost.exe PID 1224 wrote to memory of 1384 1224 Explorer.EXE svchost.exe PID 1224 wrote to memory of 1384 1224 Explorer.EXE svchost.exe PID 1224 wrote to memory of 1384 1224 Explorer.EXE svchost.exe PID 1384 wrote to memory of 2424 1384 svchost.exe cmd.exe PID 1384 wrote to memory of 2424 1384 svchost.exe cmd.exe PID 1384 wrote to memory of 2424 1384 svchost.exe cmd.exe PID 1384 wrote to memory of 2424 1384 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3a73c9c4a1e78e49f8b0649de5f5f8c5_JaffaCakes118.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mTjykhvEFtZD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4154.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2880 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2556 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2424