Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
17-08-2024 12:48
Static task
static1
Behavioral task
behavioral1
Sample
a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe
-
Size
592KB
-
MD5
a2979fe9cc6cdfef0f36e6079f11a0ef
-
SHA1
f0d213befc2b617837f4c73e82f135a9b03bd1e9
-
SHA256
f5e144e546913f82d4a09e7651d810acef969dccc81bf326aaae8cc9a2c3ce5a
-
SHA512
7b6d2ecb46a06d48ce5959e2b83f17fa53eda20db5a719bc627f40f24dcbe9fd849ddc295f1fc010d6c474b3558bb65a7f33b2ff966597defa50bd8a10485661
-
SSDEEP
6144:8CE6/mUXJ531nIUliViSZbLhaZfvMlLXICg2vj7OyzWxzRazUE1K52u8iqUNr6:86TOUMBQf0ljW2vj7OyzoRaA+e
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\49A06261 = "C:\\Users\\Admin\\AppData\\Roaming\\49A06261\\bin.exe" winver.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
winver.exea2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid process 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2264 winver.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exepid process 1820 a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exewinver.exedescription pid process target process PID 1820 wrote to memory of 2264 1820 a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe winver.exe PID 1820 wrote to memory of 2264 1820 a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe winver.exe PID 1820 wrote to memory of 2264 1820 a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe winver.exe PID 1820 wrote to memory of 2264 1820 a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe winver.exe PID 1820 wrote to memory of 2264 1820 a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe winver.exe PID 2264 wrote to memory of 1196 2264 winver.exe Explorer.EXE PID 2264 wrote to memory of 1116 2264 winver.exe taskhost.exe PID 2264 wrote to memory of 1168 2264 winver.exe Dwm.exe PID 2264 wrote to memory of 1196 2264 winver.exe Explorer.EXE PID 2264 wrote to memory of 1192 2264 winver.exe DllHost.exe PID 2264 wrote to memory of 1820 2264 winver.exe a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2264
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1192