Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 11:39
Behavioral task
behavioral1
Sample
4183be964027895500dcd44342efb88c_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
General
-
Target
4183be964027895500dcd44342efb88c_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
4183be964027895500dcd44342efb88c
-
SHA1
60444efcbb94db59298586ceba8a94db8cfd5375
-
SHA256
d8e23ffe1195d09190f39030a46d9093a9e2cf3e05ce28f91198f04f98182148
-
SHA512
687bf0bdcf805f9d2764dcf794c0dd78ccd2ce56abff09cb375e6e9a2eb5a4813469153babb2fc7f40ab3a71a80b486cd8b450605ed5d9bb2ecead0dadda7378
-
SSDEEP
24576:9ECug1PAWDEowzOQxP8l01UBhb+15AQzQNOEOOuc3+lXxGLM+4wtbZID9PWg:9FuYPAPvzOQlSfoE9uIIBSlhZIDF7
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Wine 4183be964027895500dcd44342efb88c_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2028-0-0x0000000000400000-0x0000000000714000-memory.dmp themida behavioral1/memory/2028-4-0x0000000000400000-0x0000000000714000-memory.dmp themida behavioral1/memory/2028-5-0x0000000000400000-0x0000000000714000-memory.dmp themida behavioral1/memory/2028-7-0x0000000000400000-0x0000000000714000-memory.dmp themida behavioral1/memory/2028-6-0x0000000000400000-0x0000000000714000-memory.dmp themida behavioral1/memory/2028-8-0x0000000000400000-0x0000000000714000-memory.dmp themida behavioral1/memory/2028-9-0x0000000000400000-0x0000000000714000-memory.dmp themida behavioral1/memory/2028-11-0x0000000000400000-0x0000000000714000-memory.dmp themida behavioral1/memory/2028-13-0x0000000000400000-0x0000000000714000-memory.dmp themida -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\taskmgr.exe 4183be964027895500dcd44342efb88c_JaffaCakes118.exe File created C:\Windows\SysWOW64\taskmgr.exe 4183be964027895500dcd44342efb88c_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2028 4183be964027895500dcd44342efb88c_JaffaCakes118.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3056 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3056 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 3056 2028 4183be964027895500dcd44342efb88c_JaffaCakes118.exe 29 PID 2028 wrote to memory of 3056 2028 4183be964027895500dcd44342efb88c_JaffaCakes118.exe 29 PID 2028 wrote to memory of 3056 2028 4183be964027895500dcd44342efb88c_JaffaCakes118.exe 29 PID 2028 wrote to memory of 3056 2028 4183be964027895500dcd44342efb88c_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4183be964027895500dcd44342efb88c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4183be964027895500dcd44342efb88c_JaffaCakes118.exe"1⤵
- Identifies Wine through registry keys
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\taskmgr.exeC:\Windows\system32\taskmgr.exe 708 "C:\Users\Admin\AppData\Local\Temp\4183be964027895500dcd44342efb88c_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3056
-