Analysis
-
max time kernel
12s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 03:19
Static task
static1
Behavioral task
behavioral1
Sample
44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe
-
Size
191KB
-
MD5
44135b120caaff8964a9e4aa6e8411a8
-
SHA1
9428d2f3a47cff0fbdf6d165d3795acfd435b65c
-
SHA256
5ffe33e7a37d5aa852d8cd372446a119155b455bac1ee3a1daf58cb0ebaeb598
-
SHA512
86d2ed02688ed13f405a1cbd15ab41a34c8f48f3c921c45eac11b0ea9b2a51ebbc89f814477245ec6123f82ad0c975b9dbfdffc504c7745f13ec12db61daec75
-
SSDEEP
3072:W5nG+UAk//Qge7LnM2xroN/gKEES4zVvr1r9NB+dCHPcdHyz04:W5G1AkQ97LnHxsoK3lJd9usPcdHyz04
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Systems \Parameters\ServiceDll = "C:\\Windows\\system32\\twain_32.dll" 44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 1364 svchost.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\perfhs0090.dat 44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe File created C:\Windows\SysWOW64\twain_32.dll 44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\perfcon004.dat 44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe File created C:\Windows\SysWOW64\perfcon004.dat 44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe File created C:\Windows\SysWOW64\perfhs0090.dat 44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2512 44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe 2512 44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe 2512 44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe 2512 44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe 2512 44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2512
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:1364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218B
MD5a70c645ac2373a3fe7957dc11d680cd4
SHA137573bbcfddc23dd16c8de20893462f346e40dfe
SHA256202e48928f997589982472b965865e31cc717561ac661eaaf511cffff4a374a9
SHA512023aba52898e24af864ad0b14344427c6c0202266fab1ee2adbb53435321ae787729b4654a00c226d053abd6144fa792246087d07c107885f4f8629078bf0657
-
Filesize
331KB
MD52d4c240fd5ff62ffda4e345d8d72e453
SHA17e80a7b012ed4aedfd9f92470941e95ea1bd6da6
SHA256993206550ff37304c403f3b60615da21615af5a33ecc8242126f6e13dcac0551
SHA512d331225e4b3e1006b20a557c1e959189ce21c70a811eab120fe5061f4931ae32ce37c124741dbebe9a9ca766920f7b53084762b40f1accf8743d4b20b13a9b4c