Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-09-2024 14:29
Behavioral task
behavioral1
Sample
d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe
-
Size
134KB
-
MD5
d491fdea125fa1441c2a08c0ab3b7545
-
SHA1
8200981affa2c27ea02abcbaa21f3845d06b178d
-
SHA256
3646ed9c9fefca0d08e9c661a85adff49932d22fdbedf4217d0f6904e21b55df
-
SHA512
7256af7c4b8dc0f06a5385fe7bc3e607a8962f19e554b91d5947ec80be550fecae30c6be3e7d16edc031f32c7432719048ced0d3c1263e6424a04959c4b8f9c1
-
SSDEEP
3072:b6rFaxkvDIfkIU+gqBEniJV00ylr/bROHPK6:GrFWkLwhFOnQ00ypbMHP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2272 Qconoa.exe -
resource yara_rule behavioral1/memory/2124-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0008000000016334-8.dat upx behavioral1/memory/2272-10-0x0000000000400000-0x000000000043B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\KCSCPW1HKH = "C:\\Windows\\Qconoa.exe" Qconoa.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe File opened for modification C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe File created C:\Windows\Qconoa.exe d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe File opened for modification C:\Windows\Qconoa.exe d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qconoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main Qconoa.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International Qconoa.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe 2272 Qconoa.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2272 2124 d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe 28 PID 2124 wrote to memory of 2272 2124 d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe 28 PID 2124 wrote to memory of 2272 2124 d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe 28 PID 2124 wrote to memory of 2272 2124 d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\Qconoa.exeC:\Windows\Qconoa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD5d491fdea125fa1441c2a08c0ab3b7545
SHA18200981affa2c27ea02abcbaa21f3845d06b178d
SHA2563646ed9c9fefca0d08e9c661a85adff49932d22fdbedf4217d0f6904e21b55df
SHA5127256af7c4b8dc0f06a5385fe7bc3e607a8962f19e554b91d5947ec80be550fecae30c6be3e7d16edc031f32c7432719048ced0d3c1263e6424a04959c4b8f9c1
-
Filesize
372B
MD515f15e45ea4235d089ec36d4e00333ea
SHA1d832aa3addfff3adfb4dfe46df7a438deb812d47
SHA25652a0d8b3e81590e724da329ba7d5534cf8dfd30e3747ed46103d7d3fee1b8114
SHA512b8f54357d6c9d2f51cf4f56a6b0775c3238cb9d339c1378db618f902ee459de1a4820f189698ead25bf4e234e9cc88f6f026458a40c197e57ba60c1f3837005e