Analysis

  • max time kernel
    135s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-07-2024 21:20

General

  • Target

    4361ae928291a2a44087f355d34950f0_JaffaCakes118.exe

  • Size

    155KB

  • MD5

    4361ae928291a2a44087f355d34950f0

  • SHA1

    25db4306dd8b25bb17ce26d4fc7d908568fa3fe8

  • SHA256

    9206fc5ec60a5a75ecfb8c5d4642f3ab51559ae4de05bd77a2367851dcb56aac

  • SHA512

    6e3fac97cafe2a0f3b872f8bfbc565e96e2eef893f19e83fb259a4bb4510b755461127c5ca807d9402e3e6baf089302ad1fb70ecc470136d23ca9877c112d5d8

  • SSDEEP

    3072:M5cTG9RYYMRNmcjg8vNWKg5i+m8TdhIdbuNywlID6yWF+OFi:M5+6LGMjgkKgnmKNyw6iF+

Malware Config

Extracted

Family

smokeloader

Botnet

ku11

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4361ae928291a2a44087f355d34950f0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4361ae928291a2a44087f355d34950f0_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    PID:1496
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 536
      2⤵
      • Program crash
      PID:5024
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1496 -ip 1496
    1⤵
      PID:5092

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\5C1B.tmp

      Filesize

      1.6MB

      MD5

      4f3387277ccbd6d1f21ac5c07fe4ca68

      SHA1

      e16506f662dc92023bf82def1d621497c8ab5890

      SHA256

      767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

      SHA512

      9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

    • memory/1496-2-0x0000000000F30000-0x0000000000F3A000-memory.dmp

      Filesize

      40KB

    • memory/1496-1-0x0000000000F20000-0x0000000000F2A000-memory.dmp

      Filesize

      40KB

    • memory/1496-0-0x0000000000F00000-0x0000000000F01000-memory.dmp

      Filesize

      4KB

    • memory/1496-7-0x0000000000F30000-0x0000000000F3A000-memory.dmp

      Filesize

      40KB