Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe
-
Size
672KB
-
MD5
8147c7099643d77c358cf75a3a63dfc5
-
SHA1
3926b6f0272bc12ce843b5d4c0d805a05c8e7c67
-
SHA256
e7eca2bf91830d3461001744032be10b2d3cf730518e5b843cf673a4727a67c9
-
SHA512
693572243d1c6df5ddc537fea2b4bae947c95c7ed35d855e1167a8573c0142efef4e6ab55178844ba144520d75c250544c2b719bd1b8aa88ba0be7c6b071cada
-
SSDEEP
12288:5ndySpiT3Qi9HCv/QPd/tVR8OputzjF3Z4mxxDm6FSDZWcAIc+cD:R4gOAi9iHWkOYtjQmXDpEDRAY8
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1776 1EXE~1.EXE 2520 RunMgr.EXE 2988 fsdf.exe -
Loads dropped DLL 3 IoCs
pid Process 1680 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe 1680 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe 1776 1EXE~1.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\uninstal.BAT RunMgr.EXE File created C:\Windows\RunMgr.EXE 1EXE~1.EXE File created C:\Windows\fsdf.exe RunMgr.EXE File opened for modification C:\Windows\fsdf.exe RunMgr.EXE File opened for modification C:\Windows\RunMgr.EXE RunMgr.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EXE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RunMgr.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fsdf.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1776 1EXE~1.EXE Token: SeDebugPrivilege 2520 RunMgr.EXE Token: SeDebugPrivilege 2988 fsdf.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 fsdf.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1680 wrote to memory of 1776 1680 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe 30 PID 1680 wrote to memory of 1776 1680 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe 30 PID 1680 wrote to memory of 1776 1680 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe 30 PID 1680 wrote to memory of 1776 1680 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe 30 PID 1680 wrote to memory of 1776 1680 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe 30 PID 1680 wrote to memory of 1776 1680 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe 30 PID 1680 wrote to memory of 1776 1680 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe 30 PID 1776 wrote to memory of 2520 1776 1EXE~1.EXE 31 PID 1776 wrote to memory of 2520 1776 1EXE~1.EXE 31 PID 1776 wrote to memory of 2520 1776 1EXE~1.EXE 31 PID 1776 wrote to memory of 2520 1776 1EXE~1.EXE 31 PID 1776 wrote to memory of 2520 1776 1EXE~1.EXE 31 PID 1776 wrote to memory of 2520 1776 1EXE~1.EXE 31 PID 1776 wrote to memory of 2520 1776 1EXE~1.EXE 31 PID 1776 wrote to memory of 2340 1776 1EXE~1.EXE 32 PID 1776 wrote to memory of 2340 1776 1EXE~1.EXE 32 PID 1776 wrote to memory of 2340 1776 1EXE~1.EXE 32 PID 1776 wrote to memory of 2340 1776 1EXE~1.EXE 32 PID 1776 wrote to memory of 2340 1776 1EXE~1.EXE 32 PID 1776 wrote to memory of 2340 1776 1EXE~1.EXE 32 PID 1776 wrote to memory of 2340 1776 1EXE~1.EXE 32 PID 1776 wrote to memory of 576 1776 1EXE~1.EXE 34 PID 1776 wrote to memory of 576 1776 1EXE~1.EXE 34 PID 1776 wrote to memory of 576 1776 1EXE~1.EXE 34 PID 1776 wrote to memory of 576 1776 1EXE~1.EXE 34 PID 1776 wrote to memory of 576 1776 1EXE~1.EXE 34 PID 1776 wrote to memory of 576 1776 1EXE~1.EXE 34 PID 1776 wrote to memory of 576 1776 1EXE~1.EXE 34 PID 2520 wrote to memory of 2936 2520 RunMgr.EXE 37 PID 2520 wrote to memory of 2936 2520 RunMgr.EXE 37 PID 2520 wrote to memory of 2936 2520 RunMgr.EXE 37 PID 2520 wrote to memory of 2936 2520 RunMgr.EXE 37 PID 2520 wrote to memory of 2936 2520 RunMgr.EXE 37 PID 2520 wrote to memory of 2936 2520 RunMgr.EXE 37 PID 2520 wrote to memory of 2936 2520 RunMgr.EXE 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1EXE~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1EXE~1.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\RunMgr.EXE"C:\Windows\RunMgr.EXE"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\uninstal.BAT4⤵
- System Location Discovery: System Language Discovery
PID:2936
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del %SystemRoot%\Debug.exe3⤵
- System Location Discovery: System Language Discovery
PID:2340
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1EXE~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:576
-
-
-
C:\Windows\fsdf.exeC:\Windows\fsdf.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
332KB
MD57e88459b69c8e097c6db653af3a97f43
SHA1d97164aae8bf80b8fa94d9dfaecfba8f266abe8f
SHA256124a56123041af2df5af4d38c356dee0b61705d84cb4d6f1470305138aad1f06
SHA512ac0f436e90c68ab73aaa2befecf07265d0bef70651ed989b688b80caa517dec76e6745a293bf302674316dd0e4f3ea7f43371c6737f2bae8ff36170519205c1e
-
Filesize
280KB
MD5b71bb3319581724a2765e2a320dfb3b0
SHA10c9a35b863275bf605c64013bb3fa11c26a3f3d1
SHA2561ba8e4c48eb94f6fe21018c3064875756c67b4d9b908ff3167a2703f40cf8f19
SHA51294568ee0a1b3c242f5be6043760a7de6f49136bc70935b33caa0a80bd9702aebd52e0381efa4926fed2f9d2e903cc5cd27ee85a6f3b5c7f98466d183d89db0fd
-
Filesize
92B
MD510a77a8bff880d8c56bc4d878e7dc63c
SHA1d802f97e663c87517bf9de4faf2a4eedada1491e
SHA256b6969a0db11217adf76be053c7c88f8b44da393eeec554929b2f84831b52b708
SHA512473cb01ff9dc9bdd05f9f458188514bf92a6c6221ae4d4e8ad0b1a297d7d032c45e113d33eef8a05ca69cf307c64f4aca8607cba21f8aedbf02078bf71630d6b