Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 05:32
Behavioral task
behavioral1
Sample
120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe
-
Size
298KB
-
MD5
120902d5c338ec0b0455905ddcb44124
-
SHA1
71a54806200eb0e547e305bd9edaa51f2d05c2dd
-
SHA256
a0f0a34fbf6aed8db005fa2821a4b91798e50ca6f406ab01cee346db98929558
-
SHA512
6ac17f5f35a5263b837b664174eedebf55b25c82742ad611c68009f5fef4d412acd2cf00c03263d777e31d4ac3ee42bd3e811822ab51aa124154cd3293e6a4f8
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIY5:v6Wq4aaE6KwyF5L0Y2D1PqLw
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 2 IoCs
pid Process 2360 svhost.exe 1196 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\z: svhost.exe -
AutoIT Executable 18 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1992-703-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2360-803-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-1164-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-1163-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1992-1513-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-2311-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-3459-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-4605-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-5752-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-6901-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-7932-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-9077-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-10226-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-11371-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-12518-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-13669-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-14814-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1196-15959-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/1992-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x0007000000012117-4.dat upx behavioral1/memory/2360-5-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x0008000000016c3d-68.dat upx behavioral1/memory/1992-703-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2360-803-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-1164-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-1163-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1992-1513-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-2311-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-3459-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-4605-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-5752-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-6901-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-7932-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-9077-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-10226-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-11371-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-12518-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-13669-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-14814-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1196-15959-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Driver.db svhost.exe File created C:\Windows\svhost.exe 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1196 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 2360 svhost.exe 1196 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 2360 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 2360 svhost.exe 1196 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 2360 svhost.exe 1196 svhost.exe 2360 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe 1196 svhost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2360 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 30 PID 1992 wrote to memory of 2360 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 30 PID 1992 wrote to memory of 2360 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 30 PID 1992 wrote to memory of 2360 1992 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 30 PID 2360 wrote to memory of 1196 2360 svhost.exe 31 PID 2360 wrote to memory of 1196 2360 svhost.exe 31 PID 2360 wrote to memory of 1196 2360 svhost.exe 31 PID 2360 wrote to memory of 1196 2360 svhost.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\svhost.exeC:\Windows\svhost.exe3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1196
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD5598bbab590a2edc7141dfeaccef0eeab
SHA14d10e2b246a9df77ecd12dd233822386ee6eaa6a
SHA256a7e1dbc268636c726541bf67e6f41e40099113f68168e42f3b3a909ab96a1ba8
SHA512aa97ea967e335703e702f4242d260a8c8f3ad2a006bb462a345350f6f51abc700bf0b152069c4fbf10baeb33009944c34e66a536010f5d6162919483ea8c0447
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD5942cd65ba2b5985e32ffa0dae2ba5c1b
SHA16e8a12fed6f146f25905d63492888e842eecd33f
SHA25619e54a9d3d6cd8bcf7aa7738c7dad8f467498ea55325a95786313c61182a2b17
SHA51220daf5197e8589168c6e4fcf106d33347cd2f50886bab622e09447d68c097615183b618ac827f9c0a731f3da802adc4d7c89ec0625608d150d0fe3e2f3da1bce