Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 10:27
Behavioral task
behavioral1
Sample
3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe
-
Size
960KB
-
MD5
3f53d646dac6bb85377b4fc336985d9a
-
SHA1
f4a863af69b32aca3fd6b363b9891cae1bbab779
-
SHA256
d6fe14f9ad1982af85a80ad2f22d5b8a4a37cdfe5e93c9236389b593808b5702
-
SHA512
19fa9a7bc1fa9ee59f5037faaec6728809c2b9778655d8db7924d63512c77fb437e6e3df8c2a9e6aff1f236fd3eb0b48dbe3850c5b60bf93b7fcf25c7b80b30b
-
SSDEEP
12288:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aaE6KwyF5L0Y2D1PqLx6Wq4aaE6KwyF5L0Yc:1thEVaPqLBthEVaPqLHthEVaPqLTthq
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 4984 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\e: svhost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/868-745-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral2/memory/4984-1104-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/868-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x000b000000023b8f-3.dat upx behavioral2/memory/4984-5-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x0009000000023ba6-123.dat upx behavioral2/memory/868-745-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/4984-1104-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4984 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe 4984 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 868 wrote to memory of 4984 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 85 PID 868 wrote to memory of 4984 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 85 PID 868 wrote to memory of 4984 868 3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3f53d646dac6bb85377b4fc336985d9a_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD5a784ffa86d44059b286eb898dbe23f24
SHA10b090b914d6f465e5165e07797af76ae09536797
SHA256f9661248d4741590f4147fef6b8d72ea19229311704a1c49aa98743b9bff8448
SHA512e392813eb7435a4fb4fdc14291d4b7ccac7b0fb3deadeb82e952db7b443a74089cad47dde51ead908ac12587eb32b5ff26a3bfe0b604f794c5d5f002d36fc478
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
960KB
MD5168da93ae3e56c600264226b0c3d9d7d
SHA1511d163ab599575aa48b454a8930307178943729
SHA25695e76cafa80f2622f57f38b22f87d1b2c82b67a3d56a7f0487cce866da670427
SHA512530228fe37c6d46b94beca06874d9c5b0ef7a37af0b43b1d0cc67510de4c4a261566f56cc7efc6a01aea11d05174a387e73739d76976df6b3319258d6237f482