Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 20:34
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe
-
Size
104KB
-
MD5
437298c4fbec9e4ef812f7324ffaf4b6
-
SHA1
4468814c74f41a69d7cbc73c0e80edb02889c1f6
-
SHA256
c1b8f071d7ca85637086f1a38873d86937aa1b180de301ff3ef7211dcefc0922
-
SHA512
d9c2ecd4a131466cb49e77016b062e802848cdc70343d7b56a320d5c62222d816540469a58fb4110e807a1762aa4a3f902b4c97c78d1d5bd4d154273ecd6766c
-
SSDEEP
1536:QM6jnaxvwQ5zttkv7EoIzUY9OXkHAoFWVL5zzgeWk8x7o1/ilEXeUKfZ0s3mYzz3:EgwWzoIoIUXkH61Mdkg7ogGYAuz3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2448 zzbrenkzz.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Wine JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Wine zzbrenkzz.exe -
Loads dropped DLL 6 IoCs
pid Process 1528 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\aksjbnvbdhabnsghdhurh = "C:\\Users\\Admin\\AppData\\Roaming\\zzbrenkzz.exe" JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum zzbrenkzz.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 zzbrenkzz.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Users\\Admin\\AppData\\Roaming\\zzbrenkzz.exe" JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1076 set thread context of 1528 1076 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2736 2448 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zzbrenkzz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1076 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 2448 zzbrenkzz.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1076 wrote to memory of 1528 1076 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 30 PID 1076 wrote to memory of 1528 1076 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 30 PID 1076 wrote to memory of 1528 1076 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 30 PID 1076 wrote to memory of 1528 1076 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 30 PID 1076 wrote to memory of 1528 1076 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 30 PID 1076 wrote to memory of 1528 1076 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 30 PID 1076 wrote to memory of 1528 1076 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 30 PID 1076 wrote to memory of 1528 1076 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 30 PID 1076 wrote to memory of 1528 1076 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 30 PID 1528 wrote to memory of 2448 1528 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 31 PID 1528 wrote to memory of 2448 1528 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 31 PID 1528 wrote to memory of 2448 1528 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 31 PID 1528 wrote to memory of 2448 1528 JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe 31 PID 2448 wrote to memory of 2736 2448 zzbrenkzz.exe 32 PID 2448 wrote to memory of 2736 2448 zzbrenkzz.exe 32 PID 2448 wrote to memory of 2736 2448 zzbrenkzz.exe 32 PID 2448 wrote to memory of 2736 2448 zzbrenkzz.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe"1⤵
- Identifies Wine through registry keys
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_437298c4fbec9e4ef812f7324ffaf4b6.exe2⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Roaming\zzbrenkzz.exe"C:\Users\Admin\AppData\Roaming\zzbrenkzz.exe"3⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 1284⤵
- Loads dropped DLL
- Program crash
PID:2736
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD5437298c4fbec9e4ef812f7324ffaf4b6
SHA14468814c74f41a69d7cbc73c0e80edb02889c1f6
SHA256c1b8f071d7ca85637086f1a38873d86937aa1b180de301ff3ef7211dcefc0922
SHA512d9c2ecd4a131466cb49e77016b062e802848cdc70343d7b56a320d5c62222d816540469a58fb4110e807a1762aa4a3f902b4c97c78d1d5bd4d154273ecd6766c