Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe
-
Size
615KB
-
MD5
da6786d4323339c99e631c43d6a95764
-
SHA1
32939704cb6c5e10d0bfe36a34f1b2fd06abad7e
-
SHA256
8e4fef2e7850fd1ce73edd2e5a5bca00f36ad8b9e4bf68e514daaffd6a54731e
-
SHA512
3f0a835bc5d3327f7c3d89d20330ab49335a9b5195a378dfa5e9f604dfb5b66af178f1aa4a51346bcf942a581977a9640a72b20683151d624ef201da1c901d9d
-
SSDEEP
12288:KaJYEoUmZS6VqK6fECF/nedEXqKCURbxlgeMHCina8x0qQYXlJq5fwSL8Z:K2nKh6fEWnedCDt+yMKE1Jp48Z
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2736 SVCHOST.EXE 2696 Pinnacle.exe -
resource yara_rule behavioral1/memory/2696-21-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral1/files/0x00070000000160a5-19.dat upx behavioral1/memory/2696-25-0x0000000000400000-0x00000000004A4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SVCHOST = "c:\\windows\\SVCHOST.EXE" da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2696-25-0x0000000000400000-0x00000000004A4000-memory.dmp autoit_exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created \??\c:\windows\SVCHOST.EXE da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe File created \??\c:\windows\Pinnacle.exe da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe File opened for modification \??\c:\windows\svchost.inf SVCHOST.EXE File created \??\c:\windows\svchost.inf da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pinnacle.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2696 Pinnacle.exe 2736 SVCHOST.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe 2696 Pinnacle.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2736 SVCHOST.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2736 2488 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 30 PID 2488 wrote to memory of 2736 2488 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 30 PID 2488 wrote to memory of 2736 2488 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 30 PID 2488 wrote to memory of 2736 2488 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 30 PID 2488 wrote to memory of 2696 2488 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 31 PID 2488 wrote to memory of 2696 2488 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 31 PID 2488 wrote to memory of 2696 2488 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 31 PID 2488 wrote to memory of 2696 2488 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\windows\SVCHOST.EXE"C:\windows\SVCHOST.EXE"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2736
-
-
C:\windows\Pinnacle.exe"C:\windows\Pinnacle.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD5b2755b1b19afb6f091b95a04fcfc7e32
SHA113bb01e2c504b1d76ad20931c33bf1361b8a07e8
SHA2568ec3c7cc0cade861b181c9ebe19b970ee5bdad92cc50d1fc5de8bcc1b3b831ac
SHA5120ee56aa01f3861179aed1790b2ac619c3b0e03ceda4e188fdced6b49c5f9e7d3bbc510f54e8e7b69dcaee2f92594d9e536982e4e5bd4eda5763941651661669e
-
Filesize
500KB
MD50cdc7a7f8804f6cdc41ced97605a8613
SHA1975a9c0a7607345f2bb92e6b534bafca1a58e779
SHA256386b1a18f4fe8962990cc021bd0dd3e75e4ed613d7cc0ae7093ed534a9ec3d2f
SHA5128987592798d0cd8a249dce2836ae822a53ca57595fe801ca3ced840892b539546267bd95e7e54de0c9c49f427ae8742ac8f699daabc64bcfae21a37f7203f563
-
Filesize
3B
MD5a5ea0ad9260b1550a14cc58d2c39b03d
SHA1f0aedf295071ed34ab8c6a7692223d22b6a19841
SHA256f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04
SHA5127c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74