Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-09-2024 13:04
Static task
static1
Behavioral task
behavioral1
Sample
e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe
-
Size
108KB
-
MD5
e6e279f1a938bb1a0d6771102ecf7473
-
SHA1
6c63d691151286f95bdc32a784d7c89af4f9dda5
-
SHA256
3f037bf4df8f5cc4573f51d846990347d85f2ccd5388240a64594ce24cc4c5ff
-
SHA512
de082becd9b3ad6f6cd3f2c88f5e5918008fb3f0d05cb638004fdef9ca30572dd24a0192b22b8ad33370148e3650ea8f7b8c10b7dd4e635a34e566725b3a7709
-
SSDEEP
3072:BGwQXaREou7H7A5GQLcMSGikCJQ+nek9V:0wvRxkJEqU5+Zf
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat idebuglangs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idebuglangs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idebuglangs.exe -
Modifies data under HKEY_USERS 25 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad idebuglangs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 idebuglangs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 idebuglangs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings idebuglangs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 idebuglangs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-bf-e0-0d-4a\WpadDecision = "0" idebuglangs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-bf-e0-0d-4a\WpadDecisionTime = 50ea956f0209db01 idebuglangs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42C6E237-002A-4A84-A74E-9F2E812C4D68}\WpadDecisionReason = "1" idebuglangs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42C6E237-002A-4A84-A74E-9F2E812C4D68}\WpadDecision = "0" idebuglangs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42C6E237-002A-4A84-A74E-9F2E812C4D68}\WpadNetworkName = "Network 3" idebuglangs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" idebuglangs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings idebuglangs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42C6E237-002A-4A84-A74E-9F2E812C4D68}\62-68-bf-e0-0d-4a idebuglangs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-bf-e0-0d-4a\WpadDecisionReason = "1" idebuglangs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-bf-e0-0d-4a\WpadDecisionTime = f007d8330209db01 idebuglangs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix idebuglangs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-bf-e0-0d-4a idebuglangs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" idebuglangs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 idebuglangs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42C6E237-002A-4A84-A74E-9F2E812C4D68} idebuglangs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42C6E237-002A-4A84-A74E-9F2E812C4D68}\WpadDecisionTime = f007d8330209db01 idebuglangs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-bf-e0-0d-4a\WpadDetectedUrl idebuglangs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections idebuglangs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" idebuglangs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42C6E237-002A-4A84-A74E-9F2E812C4D68}\WpadDecisionTime = 50ea956f0209db01 idebuglangs.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2636 idebuglangs.exe 2636 idebuglangs.exe 2636 idebuglangs.exe 2636 idebuglangs.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2400 e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 4 IoCs
pid Process 800 e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe 2400 e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe 2456 idebuglangs.exe 2636 idebuglangs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 800 wrote to memory of 2400 800 e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe 28 PID 800 wrote to memory of 2400 800 e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe 28 PID 800 wrote to memory of 2400 800 e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe 28 PID 800 wrote to memory of 2400 800 e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe 28 PID 2456 wrote to memory of 2636 2456 idebuglangs.exe 30 PID 2456 wrote to memory of 2636 2456 idebuglangs.exe 30 PID 2456 wrote to memory of 2636 2456 idebuglangs.exe 30 PID 2456 wrote to memory of 2636 2456 idebuglangs.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\e6e279f1a938bb1a0d6771102ecf7473_JaffaCakes118.exe--86ab1a212⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:2400
-
-
C:\Windows\SysWOW64\idebuglangs.exe"C:\Windows\SysWOW64\idebuglangs.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\idebuglangs.exe--cb7cff112⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2636
-