Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 20:13
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe
-
Size
639KB
-
MD5
db242e94577e5eea7344c429ccd21f40
-
SHA1
c40e5f2719c6b3a36cee454021e44e632d15a2e0
-
SHA256
f20812860c163a579fbe3bf153f1b1fa6dd2a8c22e353da39f5a9e1232659ecc
-
SHA512
8efc14a92364a5fadf93681e29cfb3c6d514bb2ea8e4394e4b8e62c180026a8389c339483e6f3e733d2409d14a7d759b1a08192e81342cee747746aa91dea9df
-
SSDEEP
12288:9hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcbNyr:LRmJkcoQricOIQxiZY1WNyr
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 1632 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\t: svhost.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4012-0-0x0000000000400000-0x00000000004B5000-memory.dmp autoit_exe behavioral2/files/0x0008000000023430-3.dat autoit_exe behavioral2/files/0x0002000000022aa8-123.dat autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1632 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe 1632 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4012 wrote to memory of 1632 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 83 PID 4012 wrote to memory of 1632 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 83 PID 4012 wrote to memory of 1632 4012 db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\db242e94577e5eea7344c429ccd21f40_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
639KB
MD5c50ef2e49bec2149aff0119b4c364273
SHA15ccf4629aa2fb06ebc5dbe7123c03471367cd7ee
SHA25617acf1a1a99154f231983879be854df1e0a9d19572a92b9fc1883a9572ff6554
SHA5124f336a6fe4fcb5ec98ba4a3e8008ed1b23209cd1daf592483a2a4945cfb0627a41a40e5e86ec2429d4e05d26188a7834332c90f69656bd956bc56e748bf52ab9
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
639KB
MD5efe9e443aee01399f714e2248bd5d374
SHA145f3776929042e2dac205a2f00a3af32b697d772
SHA256d685cc56c0b534ab122ada78cf98f647823e6944c029cc25d574b9f696797fba
SHA5121f31b8d46971af8af9e845695b9b5921fde08596156ed203200f272e02bea07c7093b45362148200f1fd5c7f0f388f2f7fe5484e42c61acfc4127c496d55055e