Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29-08-2024 23:30
Behavioral task
behavioral1
Sample
c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe
-
Size
144KB
-
MD5
c9d8a1567baec7320f844d6415560ae5
-
SHA1
9adf3ba3b223a7c2ed10b68b7df74b150137b400
-
SHA256
84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689
-
SHA512
f7b93cbd8694f0536a3b45c4f9164543ca5e3f178aa3281e5470f4ce9809fcb2a8aa6df1118f1e6d70f7172b38fe4226dfd4d68f35ff17fc07a6599aba44d9d7
-
SSDEEP
3072:bltrbkFEEqOWYnLdLfD/g5fVVqZZ5lYkj:bvwFEEqPYnLtf74DqZ+0
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
texturejobs.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat texturejobs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exec9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exetexturejobs.exetexturejobs.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language texturejobs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language texturejobs.exe -
Modifies data under HKEY_USERS 21 IoCs
Processes:
texturejobs.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 texturejobs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" texturejobs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 texturejobs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B15B16BC-77A5-4C5F-B6F0-10E05BFA25D4}\WpadDecisionReason = "1" texturejobs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B15B16BC-77A5-4C5F-B6F0-10E05BFA25D4}\WpadDecision = "0" texturejobs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-96-af-4b-20-96\WpadDecisionReason = "1" texturejobs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-96-af-4b-20-96\WpadDecisionTime = 304c9d856bfada01 texturejobs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings texturejobs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings texturejobs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 texturejobs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B15B16BC-77A5-4C5F-B6F0-10E05BFA25D4}\WpadNetworkName = "Network 3" texturejobs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-96-af-4b-20-96\WpadDecision = "0" texturejobs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix texturejobs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B15B16BC-77A5-4C5F-B6F0-10E05BFA25D4} texturejobs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B15B16BC-77A5-4C5F-B6F0-10E05BFA25D4}\c2-96-af-4b-20-96 texturejobs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" texturejobs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" texturejobs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad texturejobs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B15B16BC-77A5-4C5F-B6F0-10E05BFA25D4}\WpadDecisionTime = 304c9d856bfada01 texturejobs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-96-af-4b-20-96 texturejobs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections texturejobs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
texturejobs.exepid process 2536 texturejobs.exe 2536 texturejobs.exe 2536 texturejobs.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exepid process 2088 c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exec9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exetexturejobs.exetexturejobs.exepid process 756 c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe 2088 c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe 2520 texturejobs.exe 2536 texturejobs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exetexturejobs.exedescription pid process target process PID 756 wrote to memory of 2088 756 c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe PID 756 wrote to memory of 2088 756 c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe PID 756 wrote to memory of 2088 756 c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe PID 756 wrote to memory of 2088 756 c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe PID 2520 wrote to memory of 2536 2520 texturejobs.exe texturejobs.exe PID 2520 wrote to memory of 2536 2520 texturejobs.exe texturejobs.exe PID 2520 wrote to memory of 2536 2520 texturejobs.exe texturejobs.exe PID 2520 wrote to memory of 2536 2520 texturejobs.exe texturejobs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\c9d8a1567baec7320f844d6415560ae5_JaffaCakes118.exe--6304abef2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:2088
-
C:\Windows\SysWOW64\texturejobs.exe"C:\Windows\SysWOW64\texturejobs.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\texturejobs.exe--cc8e73072⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2536