Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 05:32
Behavioral task
behavioral1
Sample
120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe
-
Size
298KB
-
MD5
120902d5c338ec0b0455905ddcb44124
-
SHA1
71a54806200eb0e547e305bd9edaa51f2d05c2dd
-
SHA256
a0f0a34fbf6aed8db005fa2821a4b91798e50ca6f406ab01cee346db98929558
-
SHA512
6ac17f5f35a5263b837b664174eedebf55b25c82742ad611c68009f5fef4d412acd2cf00c03263d777e31d4ac3ee42bd3e811822ab51aa124154cd3293e6a4f8
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIY5:v6Wq4aaE6KwyF5L0Y2D1PqLw
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 992 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\o: svhost.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3480-768-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-1130-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-1132-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-2264-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-3408-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-4545-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-5673-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-6811-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-7946-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-9081-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-10220-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-11362-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-12499-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-13523-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-14660-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/992-15803-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/3480-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x000800000002344f-3.dat upx behavioral2/files/0x0007000000023456-122.dat upx behavioral2/memory/3480-768-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-1130-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-1132-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-2264-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-3408-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-4545-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-5673-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-6811-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-7946-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-9081-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-10220-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-11362-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-12499-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-13523-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-14660-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/992-15803-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Driver.db svhost.exe File created C:\Windows\svhost.exe 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 992 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe 992 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3480 wrote to memory of 992 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 82 PID 3480 wrote to memory of 992 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 82 PID 3480 wrote to memory of 992 3480 120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\120902d5c338ec0b0455905ddcb44124_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD536a5eb5de60e6abaa78001901ad2380c
SHA1b4e38179e7aeed3638fe4a38a5df193c82801397
SHA256e53bc9c92f410f5bd875c0b535bc9d4018dc6654228b971661aa0417ac9d0133
SHA512e7e485cf8029093cb829479e13cf06445ea1318ef61f828f7b5bae1b4461dd7ce39b74ef925ea94767c189dc510564c99c482b87ad05ef34fd90c1a2f977c4c3
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD5942cd65ba2b5985e32ffa0dae2ba5c1b
SHA16e8a12fed6f146f25905d63492888e842eecd33f
SHA25619e54a9d3d6cd8bcf7aa7738c7dad8f467498ea55325a95786313c61182a2b17
SHA51220daf5197e8589168c6e4fcf106d33347cd2f50886bab622e09447d68c097615183b618ac827f9c0a731f3da802adc4d7c89ec0625608d150d0fe3e2f3da1bce