Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 10:22
Static task
static1
Behavioral task
behavioral1
Sample
73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe
-
Size
244KB
-
MD5
73a62d9879926cc9e6d46a172c8c7ee6
-
SHA1
4f748aa60caf62469492856a99053514b65b1e94
-
SHA256
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3
-
SHA512
f2aace748be4dc1f330abce4f4a65ee1f29242a49b3759469304a28ca379f989c215da6a94ee2a2f234c6cc76629e5dcd23e8f137e905a2713ff73c2e9b6b009
-
SSDEEP
6144:6b/t2ebYNZtTck5NIG69kA9EgD5j6xzD:o/tKRc0bkFEMjO
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
slidedaf.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat slidedaf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exeslidedaf.exeslidedaf.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language slidedaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language slidedaf.exe -
Modifies data under HKEY_USERS 19 IoCs
Processes:
slidedaf.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 slidedaf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad slidedaf.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ae000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 slidedaf.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A6DE1134-556A-44FD-A4F3-9D64DAC19EFC} slidedaf.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f4-30-3a-9b-09\WpadDecisionTime = f0a309d445dfda01 slidedaf.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings slidedaf.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A6DE1134-556A-44FD-A4F3-9D64DAC19EFC}\WpadDecisionTime = f0a309d445dfda01 slidedaf.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f4-30-3a-9b-09\WpadDecision = "0" slidedaf.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f4-30-3a-9b-09\WpadDecisionReason = "1" slidedaf.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 slidedaf.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A6DE1134-556A-44FD-A4F3-9D64DAC19EFC}\WpadDecisionReason = "1" slidedaf.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A6DE1134-556A-44FD-A4F3-9D64DAC19EFC}\WpadDecision = "0" slidedaf.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A6DE1134-556A-44FD-A4F3-9D64DAC19EFC}\WpadNetworkName = "Network 3" slidedaf.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A6DE1134-556A-44FD-A4F3-9D64DAC19EFC}\82-f4-30-3a-9b-09 slidedaf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections slidedaf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings slidedaf.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" slidedaf.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f4-30-3a-9b-09 slidedaf.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f4-30-3a-9b-09\WpadDetectedUrl slidedaf.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exeslidedaf.exeslidedaf.exepid process 2536 73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe 2004 73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe 2372 slidedaf.exe 2132 slidedaf.exe 2132 slidedaf.exe 2132 slidedaf.exe 2132 slidedaf.exe 2132 slidedaf.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exepid process 2004 73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exeslidedaf.exedescription pid process target process PID 2536 wrote to memory of 2004 2536 73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe 73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe PID 2536 wrote to memory of 2004 2536 73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe 73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe PID 2536 wrote to memory of 2004 2536 73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe 73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe PID 2536 wrote to memory of 2004 2536 73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe 73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe PID 2372 wrote to memory of 2132 2372 slidedaf.exe slidedaf.exe PID 2372 wrote to memory of 2132 2372 slidedaf.exe slidedaf.exe PID 2372 wrote to memory of 2132 2372 slidedaf.exe slidedaf.exe PID 2372 wrote to memory of 2132 2372 slidedaf.exe slidedaf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\73a62d9879926cc9e6d46a172c8c7ee6_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\slidedaf.exe"C:\Windows\SysWOW64\slidedaf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\slidedaf.exe"C:\Windows\SysWOW64\slidedaf.exe"2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2004-12-0x0000000000250000-0x000000000026A000-memory.dmpFilesize
104KB
-
memory/2004-28-0x0000000000250000-0x000000000026A000-memory.dmpFilesize
104KB
-
memory/2004-27-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2132-25-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/2132-24-0x00000000003D0000-0x00000000003EA000-memory.dmpFilesize
104KB
-
memory/2132-20-0x00000000003D0000-0x00000000003EA000-memory.dmpFilesize
104KB
-
memory/2132-26-0x0000000000250000-0x0000000000260000-memory.dmpFilesize
64KB
-
memory/2132-29-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/2372-13-0x0000000000250000-0x000000000026A000-memory.dmpFilesize
104KB
-
memory/2372-19-0x00000000003E0000-0x00000000003F0000-memory.dmpFilesize
64KB
-
memory/2372-17-0x0000000000250000-0x000000000026A000-memory.dmpFilesize
104KB
-
memory/2372-18-0x00000000001B0000-0x00000000001CA000-memory.dmpFilesize
104KB
-
memory/2536-5-0x0000000000250000-0x000000000026A000-memory.dmpFilesize
104KB
-
memory/2536-4-0x0000000000270000-0x000000000028A000-memory.dmpFilesize
104KB
-
memory/2536-6-0x0000000000290000-0x00000000002A0000-memory.dmpFilesize
64KB
-
memory/2536-0-0x0000000000270000-0x000000000028A000-memory.dmpFilesize
104KB