Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/09/2024, 00:47
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe
-
Size
638KB
-
MD5
ec835edab4db0cd046ac0431d0031093
-
SHA1
0a548a3d415a56f3615e4d71def79d835add2c3f
-
SHA256
c0f8dddd2a4bf62d306aacd2fb69ea2f8170ebcc5876f76290bd2c3a00d27610
-
SHA512
f21d6050f436c336b15b3cfc60951116e4be0fb3102d349bf5a30b0246b2140bb3b491eb17c68d5a01ff893eb8930a7037074ca4fcc94394acb4d2117fef4a23
-
SSDEEP
12288:9hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcbNyf:LRmJkcoQricOIQxiZY1WNyf
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2952 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\w: svhost.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1848-0-0x0000000000400000-0x00000000004B5000-memory.dmp autoit_exe behavioral1/files/0x000c000000016d32-4.dat autoit_exe behavioral1/files/0x0026000000018e9f-66.dat autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2952 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe 2952 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2952 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 30 PID 1848 wrote to memory of 2952 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 30 PID 1848 wrote to memory of 2952 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 30 PID 1848 wrote to memory of 2952 1848 ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ec835edab4db0cd046ac0431d0031093_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
638KB
MD50f7afefe6416fe1f796341bae4834a19
SHA12cdf7c18a26749272a54acbd2acb2cd33e2412f5
SHA2568591e6575010cd85f3c18721cd7ce26ee477be1b756c077ac8e1087f4d2b55c3
SHA5121f8062d1bdd9ab5bd5abe94e587b0b162ba9ac5cfe986f74cc3d71c6da9ce277d4288cce6a817b87d7e1af306c9e0e9b702cd5c8a278c15ee5d67556e0764c8d
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
638KB
MD5076a2f8a64f057dcd2e8b839dabafdcb
SHA1562e56e4d385837cc5186fa0465c84eebf522ef7
SHA2568f0914229b47c8cf5424ddc52430ba6cc794edcd535e6a45a867a60838986d3a
SHA5128a6e705e2e199f37e5ea8116cc4810c378b3ed8a0ab2b361c0bd8736ac41c39804c968a48829231f4e3f723ae492911d76737976543939e7f82dba29bf61de3b