Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13-07-2024 18:47
Static task
static1
Behavioral task
behavioral1
Sample
42e711a168300880731ba5200c2960cf_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
42e711a168300880731ba5200c2960cf_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
42e711a168300880731ba5200c2960cf_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
42e711a168300880731ba5200c2960cf
-
SHA1
344e8fe7bddd1383f37c0fc2e4b5d1bf8fdb6c5f
-
SHA256
333b6565cf566e10290ba78505a7c9fb0c5a993f766e6f4c54c084e2b49a0ccd
-
SHA512
86ebcb2f5117380b7f352a143731b5a16c609d85f2c40fe98ab979d54f4dbbf4e336032c933fcd9c5d4ac662e1c927d6680f034b130860204387d95b5d229ee5
-
SSDEEP
49152:F/gJxpx3pzay2mmDr0x8/2L3VJKzStFPmiujCsuLlZZ2C+UILw:F/8xD31aumHM8/s/uiKCBLYRUIE
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 972 av.exe 3048 av_movie_644.exe -
Loads dropped DLL 1 IoCs
pid Process 3048 av_movie_644.exe -
resource yara_rule behavioral2/files/0x000a0000000233f5-2.dat upx behavioral2/memory/972-5-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/972-85-0x0000000000400000-0x00000000004B4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ttk = "C:\\Program Files (x86)\\ʱ´úÓ°Ôº\\movie.exe" 42e711a168300880731ba5200c2960cf_JaffaCakes118.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/972-85-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x000800000002344c-7.dat nsis_installer_1 behavioral2/files/0x000800000002344c-7.dat nsis_installer_2 -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe 972 av.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2512 wrote to memory of 972 2512 42e711a168300880731ba5200c2960cf_JaffaCakes118.exe 85 PID 2512 wrote to memory of 972 2512 42e711a168300880731ba5200c2960cf_JaffaCakes118.exe 85 PID 2512 wrote to memory of 972 2512 42e711a168300880731ba5200c2960cf_JaffaCakes118.exe 85 PID 972 wrote to memory of 3048 972 av.exe 87 PID 972 wrote to memory of 3048 972 av.exe 87 PID 972 wrote to memory of 3048 972 av.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\42e711a168300880731ba5200c2960cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42e711a168300880731ba5200c2960cf_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\av.exe"C:\av.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:972 -
C:\av_movie_644.exeav_movie_644.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD50dc0cc7a6d9db685bf05a7e5f3ea4781
SHA15d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA2568e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
SHA512814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
-
Filesize
650B
MD52d868ce84c2830e42bafcb1e4e6d1b3b
SHA1c89a4477e98015f528b6e7cbb42edc9a59cd65de
SHA2561c37797ad5deeb5b19ae68a856b08bcd3000a75ddcfaee99f47c038ca6672e07
SHA5128d4ea7fdd5e57f5d4e9307a5a80f8bdd63daa71b52aaa7c652a4374e309f24bebf781195e98b86653804cbd23f737ebb102a807415f31695cfdbd79592cf8395
-
Filesize
273KB
MD56d7d8e46b37cbdf0eaf052d177ff3c1e
SHA1372a4786ce746e39c21817154635c965ce4d4f1b
SHA25606630a0e4266e4aae92fed3cc5af8531b0e0f77b4650d31bd6c4f5c03493f08b
SHA512974cda5bbf963cd088e7aa562374232e27de4680fc30367c19fc86dd0df685178f610b3327a0eb87a78bb06a260f6f6feae84ac77033e5d3487b4cde6e459f6d
-
Filesize
1.9MB
MD5a7537cbe797af2e898ae51b657ef2253
SHA1d8f8aac06b6ae58fb5b4c6e0ec47af3f8f06e3f8
SHA256bd7406feb2151e489fee13b3f94094036f9fb026c5115d172576d4317fb9a82c
SHA512685b1f107711ec2fd65685de0af979b176ac6642a4cd44e3f95f822e1af47072af64502d2eaad1ba24bf74856b2c36d0d69395ee8265cf4b93ed776cd1147b7a