Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 03:22
Static task
static1
Behavioral task
behavioral1
Sample
d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe
-
Size
255KB
-
MD5
d36b567510f94d57d1687552eaae6dae
-
SHA1
643a4eeed3eb21ca7c0f5e719fa6b525d828c988
-
SHA256
53d16ce250b4493be862273542deac2e51ccdfed582296e2cccb8f5ab0a71ded
-
SHA512
f7c1e477a8bb954012f2d0a3dbdcb09831e7ef045cf884068558cc1d6b1d2af3c91532303d107f070f389259220bcac33db81ec27d0f53f0099d46e57bda8ef1
-
SSDEEP
3072:qEm2GULHYJlIwjXgWcdqylAHRWvLhPep457AYDikDbZp457ATCDikDbZp457AYD3:qsGUMMwL5cIyqu5J
Malware Config
Extracted
tofsee
31.210.119.2
188.165.132.183
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Deletes itself 1 IoCs
pid Process 2884 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2828 duwfaf.exe 2800 duwfaf.exe -
Loads dropped DLL 3 IoCs
pid Process 1816 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 1816 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 2828 duwfaf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\duwfaf.exe\" /r" d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2612 set thread context of 1816 2612 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 30 PID 2828 set thread context of 2800 2828 duwfaf.exe 34 PID 2800 set thread context of 2224 2800 duwfaf.exe 35 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language duwfaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language duwfaf.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2612 wrote to memory of 1816 2612 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 30 PID 2612 wrote to memory of 1816 2612 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 30 PID 2612 wrote to memory of 1816 2612 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 30 PID 2612 wrote to memory of 1816 2612 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 30 PID 2612 wrote to memory of 1816 2612 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 30 PID 2612 wrote to memory of 1816 2612 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 30 PID 2612 wrote to memory of 1816 2612 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 30 PID 2612 wrote to memory of 1816 2612 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 30 PID 2612 wrote to memory of 1816 2612 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 30 PID 2612 wrote to memory of 1816 2612 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 30 PID 1816 wrote to memory of 2828 1816 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 31 PID 1816 wrote to memory of 2828 1816 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 31 PID 1816 wrote to memory of 2828 1816 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 31 PID 1816 wrote to memory of 2828 1816 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 31 PID 1816 wrote to memory of 2884 1816 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 32 PID 1816 wrote to memory of 2884 1816 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 32 PID 1816 wrote to memory of 2884 1816 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 32 PID 1816 wrote to memory of 2884 1816 d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe 32 PID 2828 wrote to memory of 2800 2828 duwfaf.exe 34 PID 2828 wrote to memory of 2800 2828 duwfaf.exe 34 PID 2828 wrote to memory of 2800 2828 duwfaf.exe 34 PID 2828 wrote to memory of 2800 2828 duwfaf.exe 34 PID 2828 wrote to memory of 2800 2828 duwfaf.exe 34 PID 2828 wrote to memory of 2800 2828 duwfaf.exe 34 PID 2828 wrote to memory of 2800 2828 duwfaf.exe 34 PID 2828 wrote to memory of 2800 2828 duwfaf.exe 34 PID 2828 wrote to memory of 2800 2828 duwfaf.exe 34 PID 2828 wrote to memory of 2800 2828 duwfaf.exe 34 PID 2800 wrote to memory of 2224 2800 duwfaf.exe 35 PID 2800 wrote to memory of 2224 2800 duwfaf.exe 35 PID 2800 wrote to memory of 2224 2800 duwfaf.exe 35 PID 2800 wrote to memory of 2224 2800 duwfaf.exe 35 PID 2800 wrote to memory of 2224 2800 duwfaf.exe 35 PID 2800 wrote to memory of 2224 2800 duwfaf.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d36b567510f94d57d1687552eaae6dae_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\duwfaf.exe"C:\Users\Admin\duwfaf.exe" /r3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\duwfaf.exe"C:\Users\Admin\duwfaf.exe" /r4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2224
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\2221.bat" "3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2884
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117B
MD577416faa4cf30b563062e2dbd924dfe4
SHA1ec4b13a48a6f9d145f0684fbccf53d62bde27e5a
SHA2569cfb682657df1777b7f9a95bb3b0c0f11dd2f8b026d65acc99ecccd86bdcb2d2
SHA5123a46c206270fabfc721f3c23336cc6e9a00114f6a8faaee102e58859004abfb76f864fd02cb2e39eb7b0809a118fd5bbd8aa20297c54fe2704356961e4755763
-
Filesize
255KB
MD5d36b567510f94d57d1687552eaae6dae
SHA1643a4eeed3eb21ca7c0f5e719fa6b525d828c988
SHA25653d16ce250b4493be862273542deac2e51ccdfed582296e2cccb8f5ab0a71ded
SHA512f7c1e477a8bb954012f2d0a3dbdcb09831e7ef045cf884068558cc1d6b1d2af3c91532303d107f070f389259220bcac33db81ec27d0f53f0099d46e57bda8ef1