Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14-08-2024 09:17
Static task
static1
Behavioral task
behavioral1
Sample
9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe
-
Size
32KB
-
MD5
9579d50a7aef7f57306c069a44bd058f
-
SHA1
94c6e227ec142e5b2f97a85f4e3a985e489252ec
-
SHA256
cf2a8f722a84292355c825da998a10882c4b9f90e70c5f3698bc736d75f1632c
-
SHA512
cfc3a38afffd37d778f55d950db2788d530564c6e958495aa476216e587a720bbe8eba8463de0326f562420f5569805443d118912f7365d07857e25ebb2cbdcf
-
SSDEEP
768:7fHoqqjQjVfeAM4S/WW0aVCnE6fS87CcHhTvBA6+Et/EZhF:7/TqjQ0AMj/WW0aOzfF7CcHsnfHF
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
wminit.exepid process 2280 wminit.exe -
Executes dropped EXE 1 IoCs
Processes:
wminit.exepid process 2280 wminit.exe -
Loads dropped DLL 2 IoCs
Processes:
9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exepid process 2360 9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe 2360 9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wminit = "C:\\Program Files (x86)\\Common Files\\System\\wminit.exe" 9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe -
Drops file in Program Files directory 3 IoCs
Processes:
9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exedescription ioc process File created C:\Program Files (x86)\Common Files\System\wminit.dat 9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\wminit.exe 9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\wminit.exe 9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exedescription pid process target process PID 2360 wrote to memory of 2280 2360 9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe wminit.exe PID 2360 wrote to memory of 2280 2360 9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe wminit.exe PID 2360 wrote to memory of 2280 2360 9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe wminit.exe PID 2360 wrote to memory of 2280 2360 9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe wminit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\System\wminit.exe"C:\Program Files (x86)\Common Files\System\wminit.exe" "C:\Users\Admin\AppData\Local\Temp\9579d50a7aef7f57306c069a44bd058f_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\System\wminit.datFilesize
8B
MD571e5e1f32c0c26e6e83fd1dc12fec117
SHA1d06404526604ce4f7bf731232830b5a3fc321492
SHA256910e038b6d2a27817e20fd6a1a32b907990f83fa676487ec64a7164c2da67d05
SHA51279e995bad9688f65913898da0e59db98632d067d2ed02ffef07d254d9e329d3972a6798d0c83dfb3d3d0ab942eebefe04fb4e0ccc11521cfd7ad94c257c45be8
-
\Program Files (x86)\Common Files\System\wminit.exeFilesize
32KB
MD59579d50a7aef7f57306c069a44bd058f
SHA194c6e227ec142e5b2f97a85f4e3a985e489252ec
SHA256cf2a8f722a84292355c825da998a10882c4b9f90e70c5f3698bc736d75f1632c
SHA512cfc3a38afffd37d778f55d950db2788d530564c6e958495aa476216e587a720bbe8eba8463de0326f562420f5569805443d118912f7365d07857e25ebb2cbdcf
-
memory/2280-11-0x0000000000C10000-0x0000000000CB9000-memory.dmpFilesize
676KB
-
memory/2280-13-0x0000000000C10000-0x0000000000CB9000-memory.dmpFilesize
676KB
-
memory/2280-15-0x0000000000C10000-0x0000000000CB9000-memory.dmpFilesize
676KB
-
memory/2280-17-0x0000000000C10000-0x0000000000CB9000-memory.dmpFilesize
676KB
-
memory/2280-18-0x0000000000C10000-0x0000000000CB9000-memory.dmpFilesize
676KB
-
memory/2280-20-0x0000000000C10000-0x0000000000CB9000-memory.dmpFilesize
676KB
-
memory/2280-22-0x0000000000C10000-0x0000000000CB9000-memory.dmpFilesize
676KB
-
memory/2360-8-0x0000000000C10000-0x0000000000CB9000-memory.dmpFilesize
676KB