Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 20:56
Behavioral task
behavioral1
Sample
107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe
-
Size
298KB
-
MD5
107b392280ecd6df6b893348c13c18a6
-
SHA1
c9c79dada136b7aa50a963cdb6f3bfa95c92e04c
-
SHA256
a733ef2dec43923b4994733d69ca9fd0f7920b8611596cc64c9bc3d3b2c778e0
-
SHA512
fc1d025e786de05bc97e810d2be3200c461b097e9e31c90b4a101a312eb66cd8b539aa46f73cb96d4d75d0d3450ea447a018bfec80773b69f92be596f60a08a8
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYS:v6Wq4aaE6KwyF5L0Y2D1PqLt
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 3228 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\u: svhost.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3724-774-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-1131-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-1132-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-2264-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-3406-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-4545-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-5674-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-6816-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-7955-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-9088-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-10231-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-11371-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-12502-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-13636-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-14666-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3228-15802-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/3724-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x00090000000233dc-2.dat upx behavioral2/files/0x0007000000023441-122.dat upx behavioral2/memory/3724-774-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-1131-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-1132-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-2264-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-3406-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-4545-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-5674-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-6816-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-7955-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-9088-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-10231-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-11371-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-12502-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-13636-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-14666-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3228-15802-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3228 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe 3228 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3724 wrote to memory of 3228 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 82 PID 3724 wrote to memory of 3228 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 82 PID 3724 wrote to memory of 3228 3724 107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\107b392280ecd6df6b893348c13c18a6_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD560c2318c19b00c477b30b28c6228939c
SHA1742f1a71f0765efb665e154c58747d228b26f925
SHA256cd0f47d16a4ab3d66465a3cf7719ae0448497e96c04e584e10febbc834a75ebb
SHA512e0d9c57e8100e1bd4524f46559205efe157148ff363bb2878b53bec92576e5832d74ca5511419e64eb075ac20db763f5ac50a35b8e11b4a37f6af46d7d50f173
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD5c89cbd403fb4116abb7a691a610a1712
SHA1fbb4f50fb043326a288e9f4710234ec53b53e24f
SHA256846066dfca53500ac45200cb01cdd9535aeaac99040f71fc8f54562b50c84add
SHA5127c275baf24118af73d206ba9a51a692a777058fc4aa38c30785f1adaed0de4b9119aa17ace952ce2b5ae9808f8c04123e348c8014d142e5be6805c66b07d28a2