Analysis
-
max time kernel
118s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-05-2024 01:43
Static task
static1
Behavioral task
behavioral1
Sample
0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe
-
Size
356KB
-
MD5
0ada5f2eec1893ee695758b75ebe351b
-
SHA1
554bc863b128b83ca14f20e6b08028d8a12795a0
-
SHA256
dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597
-
SHA512
0aed5d83d07d651f62527aff20438090f143f86b98d053ad2af7a14b7166980078e8383910a4e38fabb8fa0bb60fcc23e56dbc7a5750be0b5827c1fa2bed780b
-
SSDEEP
6144:kyNp69yZH/0EkNrlXLp+Pe+zXLry08lY5W99A3ywES2:pNvcEkNFL4PeP5lYUU31ES2
Malware Config
Extracted
buer
https://kackdelar.top/
Signatures
-
Processes:
resource yara_rule behavioral1/memory/3068-5-0x0000000040000000-0x000000004000C000-memory.dmp buer behavioral1/memory/3068-7-0x0000000040000000-0x000000004000C000-memory.dmp buer behavioral1/memory/3068-8-0x0000000040000000-0x000000004000C000-memory.dmp buer behavioral1/memory/3068-9-0x0000000040000000-0x000000004000C000-memory.dmp buer -
Drops startup file 1 IoCs
Processes:
0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe 0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
RegAsm.exedescription ioc process File opened (read-only) \??\A: RegAsm.exe File opened (read-only) \??\G: RegAsm.exe File opened (read-only) \??\N: RegAsm.exe File opened (read-only) \??\P: RegAsm.exe File opened (read-only) \??\V: RegAsm.exe File opened (read-only) \??\Y: RegAsm.exe File opened (read-only) \??\Z: RegAsm.exe File opened (read-only) \??\E: RegAsm.exe File opened (read-only) \??\I: RegAsm.exe File opened (read-only) \??\L: RegAsm.exe File opened (read-only) \??\M: RegAsm.exe File opened (read-only) \??\U: RegAsm.exe File opened (read-only) \??\W: RegAsm.exe File opened (read-only) \??\X: RegAsm.exe File opened (read-only) \??\B: RegAsm.exe File opened (read-only) \??\H: RegAsm.exe File opened (read-only) \??\K: RegAsm.exe File opened (read-only) \??\O: RegAsm.exe File opened (read-only) \??\R: RegAsm.exe File opened (read-only) \??\T: RegAsm.exe File opened (read-only) \??\J: RegAsm.exe File opened (read-only) \??\Q: RegAsm.exe File opened (read-only) \??\S: RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exedescription pid process target process PID 2948 set thread context of 3068 2948 0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2596 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exepid process 2948 0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2596 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exeRegAsm.exedescription pid process target process PID 2948 wrote to memory of 3068 2948 0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe RegAsm.exe PID 2948 wrote to memory of 3068 2948 0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe RegAsm.exe PID 2948 wrote to memory of 3068 2948 0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe RegAsm.exe PID 2948 wrote to memory of 3068 2948 0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe RegAsm.exe PID 2948 wrote to memory of 3068 2948 0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe RegAsm.exe PID 2948 wrote to memory of 3068 2948 0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe RegAsm.exe PID 2948 wrote to memory of 3068 2948 0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe RegAsm.exe PID 2948 wrote to memory of 3068 2948 0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe RegAsm.exe PID 3068 wrote to memory of 2596 3068 RegAsm.exe powershell.exe PID 3068 wrote to memory of 2596 3068 RegAsm.exe powershell.exe PID 3068 wrote to memory of 2596 3068 RegAsm.exe powershell.exe PID 3068 wrote to memory of 2596 3068 RegAsm.exe powershell.exe PID 3068 wrote to memory of 2596 3068 RegAsm.exe powershell.exe PID 3068 wrote to memory of 2596 3068 RegAsm.exe powershell.exe PID 3068 wrote to memory of 2596 3068 RegAsm.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0ada5f2eec1893ee695758b75ebe351b_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\084a5729148c40eb846f}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2948-0-0x0000000000E90000-0x0000000000EEE000-memory.dmpFilesize
376KB
-
memory/2948-1-0x0000000000850000-0x0000000000866000-memory.dmpFilesize
88KB
-
memory/2948-3-0x00000000007C0000-0x00000000007C3000-memory.dmpFilesize
12KB
-
memory/2948-4-0x00000000047E0000-0x00000000047E3000-memory.dmpFilesize
12KB
-
memory/3068-5-0x0000000040000000-0x000000004000C000-memory.dmpFilesize
48KB
-
memory/3068-7-0x0000000040000000-0x000000004000C000-memory.dmpFilesize
48KB
-
memory/3068-8-0x0000000040000000-0x000000004000C000-memory.dmpFilesize
48KB
-
memory/3068-9-0x0000000040000000-0x000000004000C000-memory.dmpFilesize
48KB