Analysis
-
max time kernel
149s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 18:47
Static task
static1
Behavioral task
behavioral1
Sample
42e711a168300880731ba5200c2960cf_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
42e711a168300880731ba5200c2960cf_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
42e711a168300880731ba5200c2960cf_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
42e711a168300880731ba5200c2960cf
-
SHA1
344e8fe7bddd1383f37c0fc2e4b5d1bf8fdb6c5f
-
SHA256
333b6565cf566e10290ba78505a7c9fb0c5a993f766e6f4c54c084e2b49a0ccd
-
SHA512
86ebcb2f5117380b7f352a143731b5a16c609d85f2c40fe98ab979d54f4dbbf4e336032c933fcd9c5d4ac662e1c927d6680f034b130860204387d95b5d229ee5
-
SSDEEP
49152:F/gJxpx3pzay2mmDr0x8/2L3VJKzStFPmiujCsuLlZZ2C+UILw:F/8xD31aumHM8/s/uiKCBLYRUIE
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 832 av.exe 2452 av_movie_644.exe -
Loads dropped DLL 1 IoCs
pid Process 2452 av_movie_644.exe -
resource yara_rule behavioral1/files/0x000a0000000120f9-4.dat upx behavioral1/memory/832-7-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral1/memory/832-87-0x0000000000400000-0x00000000004B4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ttk = "C:\\Program Files (x86)\\ʱ´úÓ°Ôº\\movie.exe" 42e711a168300880731ba5200c2960cf_JaffaCakes118.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/832-87-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x0008000000016d02-9.dat nsis_installer_1 behavioral1/files/0x0008000000016d02-9.dat nsis_installer_2 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2452 av_movie_644.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe 832 av.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 448 wrote to memory of 832 448 42e711a168300880731ba5200c2960cf_JaffaCakes118.exe 29 PID 448 wrote to memory of 832 448 42e711a168300880731ba5200c2960cf_JaffaCakes118.exe 29 PID 448 wrote to memory of 832 448 42e711a168300880731ba5200c2960cf_JaffaCakes118.exe 29 PID 448 wrote to memory of 832 448 42e711a168300880731ba5200c2960cf_JaffaCakes118.exe 29 PID 448 wrote to memory of 832 448 42e711a168300880731ba5200c2960cf_JaffaCakes118.exe 29 PID 448 wrote to memory of 832 448 42e711a168300880731ba5200c2960cf_JaffaCakes118.exe 29 PID 448 wrote to memory of 832 448 42e711a168300880731ba5200c2960cf_JaffaCakes118.exe 29 PID 832 wrote to memory of 2452 832 av.exe 30 PID 832 wrote to memory of 2452 832 av.exe 30 PID 832 wrote to memory of 2452 832 av.exe 30 PID 832 wrote to memory of 2452 832 av.exe 30 PID 832 wrote to memory of 2452 832 av.exe 30 PID 832 wrote to memory of 2452 832 av.exe 30 PID 832 wrote to memory of 2452 832 av.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\42e711a168300880731ba5200c2960cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42e711a168300880731ba5200c2960cf_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:448 -
C:\av.exe"C:\av.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:832 -
C:\av_movie_644.exeav_movie_644.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2452
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
611B
MD5a214e91e598753f41a570df260745dc8
SHA1b8fe5f557af22b62d619c6b81c0ba1ad12c8b05a
SHA256488c9e3ea842a4bc191125ef17bd05cb6f6cccc57063777baf55de515b485ada
SHA512aa695a1d640a9e520263c24fb1e37a2a1ee6961bc99619f0c5bad13b7c6d6ab04305b7a1fd69d5368b8d10f4c5ab28d9ec879827423730265a6aefa3ba944f58
-
Filesize
650B
MD558512ea0b2d4189ee9b4b69526e9bfa0
SHA1c2ba7b7716a0cd898c2ec670189dcfbf3920220b
SHA256b719fae93602497aa984af186db828448e5d2678db8af190735c5cbac442c99d
SHA512156578c0c5974881d942ca2caa6cc8c29062a638d3182c82a9ed4ca63ba8f9836cd6c549c2cfe6c3f7fbfe300c5704e53c4b90618c5206ef895d779d5a429f23
-
Filesize
273KB
MD56d7d8e46b37cbdf0eaf052d177ff3c1e
SHA1372a4786ce746e39c21817154635c965ce4d4f1b
SHA25606630a0e4266e4aae92fed3cc5af8531b0e0f77b4650d31bd6c4f5c03493f08b
SHA512974cda5bbf963cd088e7aa562374232e27de4680fc30367c19fc86dd0df685178f610b3327a0eb87a78bb06a260f6f6feae84ac77033e5d3487b4cde6e459f6d
-
Filesize
1.9MB
MD5a7537cbe797af2e898ae51b657ef2253
SHA1d8f8aac06b6ae58fb5b4c6e0ec47af3f8f06e3f8
SHA256bd7406feb2151e489fee13b3f94094036f9fb026c5115d172576d4317fb9a82c
SHA512685b1f107711ec2fd65685de0af979b176ac6642a4cd44e3f95f822e1af47072af64502d2eaad1ba24bf74856b2c36d0d69395ee8265cf4b93ed776cd1147b7a
-
Filesize
14KB
MD50dc0cc7a6d9db685bf05a7e5f3ea4781
SHA15d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA2568e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
SHA512814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0