Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 10:42
Behavioral task
behavioral1
Sample
0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
General
-
Target
0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe
-
Size
298KB
-
MD5
0efbcae0b6723ecd3e644fb30cbde177
-
SHA1
e1d5cec2d2fc34d6c907b95ac6f015eba92dfdb7
-
SHA256
df847cb5c836decf5865c575bc2d07ce72a3aae72187645993cdb58b49ede145
-
SHA512
4d3dc5f77a2505958faf8e694d87b521597251dd78c1671030e28a430ade0331584a5a108ea04fc07de67a453687d9cd9a8905e2b42e8f9d0e89aafca5ec16ca
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIY3:v6Wq4aaE6KwyF5L0Y2D1PqLW
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2176 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\b: svhost.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2376-804-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-1154-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-1158-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-2303-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-3452-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-4598-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-5746-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-6894-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-8038-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-9068-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-10220-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-11365-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-12511-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-13661-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-14806-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-15954-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/2376-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x000a0000000120d5-4.dat upx behavioral1/memory/2176-5-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x00060000000195c6-66.dat upx behavioral1/memory/2376-804-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-1154-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-1158-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-2303-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-3452-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-4598-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-5746-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-6894-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-8038-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-9068-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-10220-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-11365-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-12511-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-13661-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-14806-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-15954-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Driver.db svhost.exe File created C:\Windows\svhost.exe 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2176 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2176 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 30 PID 2376 wrote to memory of 2176 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 30 PID 2376 wrote to memory of 2176 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 30 PID 2376 wrote to memory of 2176 2376 0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0efbcae0b6723ecd3e644fb30cbde177_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD53d18f6aa9b60e7ebe0d2eae7a0ad3d97
SHA1d486702b809c7c42eb3034b919585d08569f66d3
SHA256755e1ac35701e7172c39816c8cc02a4c42db0419dacb393a206b99fdb9c4151b
SHA512f4abe96380620999d7c57a5ae5f7f9bab22b8859f9fa66f0d388434c822261ae2957d3b4d24be721cc04ea326bbabc772dcbdba314293dbd85d849f8eca2cfcb
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD5b7e7b85d646dad4ad28e0b114e2cfd1c
SHA172f5c5d46a4ff551739121e41c00ce16df461cf7
SHA256bcbddd8696fe5593a437af27ee988e919d87da77c5c69cf367e71838fec707ce
SHA51205507858876394f2b2ed85d2e6d52a5040bc2e4e3f03f77417e1a0518ace2dd93de7b48af0a046f74f434ede7f0174c2e05fa70cf39e74c686cd8b8dd4cf5a3f