Analysis
-
max time kernel
132s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
16-07-2024 07:41
Static task
static1
Behavioral task
behavioral1
Sample
4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe
Resource
win7-20240705-en
8 signatures
150 seconds
General
-
Target
4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe
-
Size
289KB
-
MD5
4d5fab7fea7faedb28daee4bceb224e8
-
SHA1
75647d162f986b5c81e93b057964934d7176aaea
-
SHA256
b4f28e7a94681a99224b3893ccb2845e68e02fde69528dcacb9dc36625827a94
-
SHA512
cef54aced4d56bba316441f91aa83b29e163e42373b13cfcdf6fec499981f3dc2a8cd3a00cf89969d3f1f97fa0e0a3e44a3857c5f0b2cbbe455d7cd1eea79c6e
-
SSDEEP
6144:YRZdbVzesV3nYkM3YdFx7xN3NthPtVrhtt3lhXh/p1rZJjtPQKw0oDOTKl8tqK:YRZT/YLIdFx7xN3NthPtVrhtt3lhXh/X
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat adminstarted.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E4DE1B4E-F341-474F-AA6B-F8752E57E67A} adminstarted.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E4DE1B4E-F341-474F-AA6B-F8752E57E67A}\WpadNetworkName = "Network 3" adminstarted.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E4DE1B4E-F341-474F-AA6B-F8752E57E67A}\02-ab-4e-fe-3b-f7 adminstarted.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings adminstarted.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections adminstarted.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings adminstarted.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad adminstarted.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-ab-4e-fe-3b-f7 adminstarted.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-ab-4e-fe-3b-f7\WpadDecision = "0" adminstarted.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 adminstarted.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" adminstarted.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E4DE1B4E-F341-474F-AA6B-F8752E57E67A}\WpadDecisionReason = "1" adminstarted.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E4DE1B4E-F341-474F-AA6B-F8752E57E67A}\WpadDecisionTime = b07a6aa453d7da01 adminstarted.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E4DE1B4E-F341-474F-AA6B-F8752E57E67A}\WpadDecision = "0" adminstarted.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-ab-4e-fe-3b-f7\WpadDecisionTime = b07a6aa453d7da01 adminstarted.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 adminstarted.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f012e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 adminstarted.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-ab-4e-fe-3b-f7\WpadDecisionReason = "1" adminstarted.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2512 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 2568 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 2536 adminstarted.exe 1720 adminstarted.exe 1720 adminstarted.exe 1720 adminstarted.exe 1720 adminstarted.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2568 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 4 IoCs
pid Process 2512 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 2568 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 2536 adminstarted.exe 1720 adminstarted.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2568 2512 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 30 PID 2512 wrote to memory of 2568 2512 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 30 PID 2512 wrote to memory of 2568 2512 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 30 PID 2512 wrote to memory of 2568 2512 4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe 30 PID 2536 wrote to memory of 1720 2536 adminstarted.exe 32 PID 2536 wrote to memory of 1720 2536 adminstarted.exe 32 PID 2536 wrote to memory of 1720 2536 adminstarted.exe 32 PID 2536 wrote to memory of 1720 2536 adminstarted.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4d5fab7fea7faedb28daee4bceb224e8_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:2568
-
-
C:\Windows\SysWOW64\adminstarted.exe"C:\Windows\SysWOW64\adminstarted.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\adminstarted.exe"C:\Windows\SysWOW64\adminstarted.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1720
-