Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 15:08
Static task
static1
Behavioral task
behavioral1
Sample
f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe
-
Size
32KB
-
MD5
f00f1e36c9c4799fbdd294c51cdded8e
-
SHA1
5bd0ff8ca8b7f2208dc018af7eae3deb6d66c7fc
-
SHA256
79787c2816e02177955d1f87795b73d03856d858b4f1ad96754f95f996a678ec
-
SHA512
4f7ef81041cefe7c4e3236502c86ae63f0625ce24d3c9644c0befb283dd4cf0149d060445ec1574ec6eef15a5f54e9957d3712c2d16b5999a15126dc79c470d5
-
SSDEEP
384:RW0zDIDbcO9FR8RzbBqkKCviu305EOcS11pVcM:XzDZOnWhviu306Zb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2732 winlogon.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\winlogon.exe" winlogon.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\winlogon.exe f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe File opened for modification C:\Windows\winlogon.exe f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe File created C:\Windows\winlogon.exe winlogon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe 2732 winlogon.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2720 f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe 2720 f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe 2732 winlogon.exe 2732 winlogon.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2720 wrote to memory of 2732 2720 f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe 30 PID 2720 wrote to memory of 2732 2720 f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe 30 PID 2720 wrote to memory of 2732 2720 f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe 30 PID 2720 wrote to memory of 2732 2720 f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f00f1e36c9c4799fbdd294c51cdded8e_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\winlogon.exe"C:\Windows\winlogon.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5f00f1e36c9c4799fbdd294c51cdded8e
SHA15bd0ff8ca8b7f2208dc018af7eae3deb6d66c7fc
SHA25679787c2816e02177955d1f87795b73d03856d858b4f1ad96754f95f996a678ec
SHA5124f7ef81041cefe7c4e3236502c86ae63f0625ce24d3c9644c0befb283dd4cf0149d060445ec1574ec6eef15a5f54e9957d3712c2d16b5999a15126dc79c470d5