Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2024 00:38
Behavioral task
behavioral1
Sample
157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe
-
Size
960KB
-
MD5
157ecd0bbfe6b65910880f7f9a374019
-
SHA1
38828088dbf1992e52fa299b95d7e03f13068e56
-
SHA256
bd8fae1dd44c85dbe490de39bbf362e62b5d05e09b8d5cfabf92964b958226d7
-
SHA512
3f1bb5d5fd853ea4edf219e6fb11dafa359baecf44a313681246bf7e05c47b1a1d9f315f9da403106df6b95dd7d178f33f5360178e7fe0401ba31059840c8c35
-
SSDEEP
12288:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aaE6KwyF5L0Y2D1PqLx6Wq4aaE6KwyF5L0Ye:1thEVaPqLBthEVaPqLHthEVaPqLTthE
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 812 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\i: svhost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3432-761-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral2/memory/812-1131-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/3432-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x000900000002343b-3.dat upx behavioral2/memory/812-5-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x000700000002349c-123.dat upx behavioral2/memory/3432-761-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/812-1131-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 812 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe 812 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3432 wrote to memory of 812 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 82 PID 3432 wrote to memory of 812 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 82 PID 3432 wrote to memory of 812 3432 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:812
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD54f361d90e7659c8cb0e6a6a41b422111
SHA12ef500ddaae7f92eb9f69343a7bed711e404f82a
SHA25692304c1466a69a31b57e7bd7a526c23e6f98f49a7f27c0cf056359c7d333a5dc
SHA512928ae83f0067803433ba8c589e2f9d53121fe87f752c8ff6c81fa3cbf4cc02c42e635ca7b65366a972d4775c98956b2c0fd32ec013535fbe6a9652587b678f40
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
960KB
MD5e669f68cd5b33b2c307b7204a2c9ae71
SHA18800211371874b7b4275512a01d4c4a941d995dd
SHA2565a44f4359dcd3e640094cfc44d0399d91a28d7a4a0d63d79d65893766be226b9
SHA5128d200a722b03281dd17dcf14b95ff68ddee82127e1b85a7be35055ea8f4cd6960405387c9dff1822722e945fff9ab896fc70e549eebb5b656d2f798588a5c451