Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 06:59
Behavioral task
behavioral1
Sample
16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe
-
Size
298KB
-
MD5
16a19fc697f4baf6134de7ac5fe12ef3
-
SHA1
7303dae7f4da7a6f06dfc713617af74deed9da93
-
SHA256
baea95a77c927ab5e4c921f8415c9ee9aa52daf5746c865ea09f32b8db8c7802
-
SHA512
05d7c141de7bcf21af5a3033bdae3d288d788bf68e6fbfeedd104641337a4497d794c04f7da5b0de0f528175e47bded45e7f616064d6bd5bcee27a422d601d80
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYR:v6Wq4aaE6KwyF5L0Y2D1PqLG
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 3404 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\x: svhost.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3400-761-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-1127-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-1125-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-2249-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-3392-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-4528-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-5661-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-6801-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-7937-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-9072-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-10212-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-11348-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-12483-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-13623-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-14649-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3404-15790-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/3400-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x0009000000023472-3.dat upx behavioral2/files/0x00070000000234d0-122.dat upx behavioral2/memory/3400-761-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-1127-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-1125-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-2249-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-3392-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-4528-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-5661-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-6801-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-7937-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-9072-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-10212-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-11348-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-12483-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-13623-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-14649-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3404-15790-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3404 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe 3404 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3400 wrote to memory of 3404 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 82 PID 3400 wrote to memory of 3404 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 82 PID 3400 wrote to memory of 3404 3400 16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\16a19fc697f4baf6134de7ac5fe12ef3_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD50a1fd1b459d28879bddb03176cda5bed
SHA11c7bd435799cfebc4ac6367972874b0b9ee87f95
SHA256694dc866bfc2034b1f02463635ef8ea103340783b53eab520392897400bef235
SHA512b203d783b69ae3421f3343ff15ef4c611153e7c3cd95e34bcd20e7ed3d7973f800e9238411f08ed60d5b5cf83dbb6a10ff3f21a656d4428f628c00167571aa65
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD54bf5a02c01912c36c7aca8bee177f9ca
SHA1ac2a330a4cd439ee26ebde9d7179123e7c26f5e7
SHA256e6f89713c4bdfe35654dd44d08dbbdd11b2e11b435898c3325797d3cf12f6e52
SHA5129585fa50dcda8d691aaa8654a506a5e861d511002044c00c3d8912084fc378e3d6849ea6bbb7a27c953ff7b3690478ee61197a68833589e30578b4fc869f9457