Analysis
-
max time kernel
143s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 11:27
Static task
static1
Behavioral task
behavioral1
Sample
345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe
-
Size
368KB
-
MD5
345c37943c7a7e1fd0098aab07fe3c86
-
SHA1
ff8d484c90feab90b94502fbcaff84b16eb9a280
-
SHA256
1e0fc6cf4d0b655fc2495aeb3890f382e00ec9060ab23fa0a035a5042cda6daa
-
SHA512
888e8d2f20ccf440107971e8268d06b34aa8c7e5c476f55544321780f30af52c731ada5cca83f015b607f3b61dc5be276199a9dd3cc50fd70ed47c38ca5495cd
-
SSDEEP
6144:GpWnsT313ntnJiuPn28TTc48OSswYLi9zdsPqw73hJfrhIN:+3Xnguf2ic/swVzWBJT4
Malware Config
Extracted
buer
https://162.244.81.87/
http://162.244.81.87:8080/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
gennt.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\78b520f602ee2ea4114d\\gennt.exe\"" gennt.exe -
Processes:
resource yara_rule behavioral1/memory/1796-0-0x0000000000290000-0x000000000029C000-memory.dmp buer behavioral1/memory/1796-4-0x0000000000280000-0x000000000028A000-memory.dmp buer behavioral1/memory/2564-14-0x00000000002E0000-0x00000000002EC000-memory.dmp buer -
Deletes itself 1 IoCs
Processes:
gennt.exepid process 2564 gennt.exe -
Executes dropped EXE 1 IoCs
Processes:
gennt.exepid process 2564 gennt.exe -
Loads dropped DLL 2 IoCs
Processes:
345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exepid process 1796 345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe 1796 345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
gennt.exedescription ioc process File opened (read-only) \??\G: gennt.exe File opened (read-only) \??\O: gennt.exe File opened (read-only) \??\Q: gennt.exe File opened (read-only) \??\R: gennt.exe File opened (read-only) \??\V: gennt.exe File opened (read-only) \??\Y: gennt.exe File opened (read-only) \??\A: gennt.exe File opened (read-only) \??\J: gennt.exe File opened (read-only) \??\M: gennt.exe File opened (read-only) \??\U: gennt.exe File opened (read-only) \??\Z: gennt.exe File opened (read-only) \??\L: gennt.exe File opened (read-only) \??\P: gennt.exe File opened (read-only) \??\S: gennt.exe File opened (read-only) \??\X: gennt.exe File opened (read-only) \??\K: gennt.exe File opened (read-only) \??\N: gennt.exe File opened (read-only) \??\T: gennt.exe File opened (read-only) \??\W: gennt.exe File opened (read-only) \??\B: gennt.exe File opened (read-only) \??\E: gennt.exe File opened (read-only) \??\H: gennt.exe File opened (read-only) \??\I: gennt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
gennt.exepid process 2564 gennt.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exegennt.exepid process 1796 345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe 1796 345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe 2564 gennt.exe 2564 gennt.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exegennt.exedescription pid process target process PID 1796 wrote to memory of 2564 1796 345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe gennt.exe PID 1796 wrote to memory of 2564 1796 345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe gennt.exe PID 1796 wrote to memory of 2564 1796 345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe gennt.exe PID 1796 wrote to memory of 2564 1796 345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe gennt.exe PID 2564 wrote to memory of 3020 2564 gennt.exe secinit.exe PID 2564 wrote to memory of 3020 2564 gennt.exe secinit.exe PID 2564 wrote to memory of 3020 2564 gennt.exe secinit.exe PID 2564 wrote to memory of 3020 2564 gennt.exe secinit.exe PID 2564 wrote to memory of 1628 2564 gennt.exe cmd.exe PID 2564 wrote to memory of 1628 2564 gennt.exe cmd.exe PID 2564 wrote to memory of 1628 2564 gennt.exe cmd.exe PID 2564 wrote to memory of 1628 2564 gennt.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\78b520f602ee2ea4114d\gennt.exeC:\ProgramData\78b520f602ee2ea4114d\gennt.exe "C:\Users\Admin\AppData\Local\Temp\345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Deletes itself
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\78b520f602ee2ea4114d\gennt.exe3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" powershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\78b520f602ee2ea4114d}"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\78b520f602ee2ea4114d\gennt.exeFilesize
368KB
MD5345c37943c7a7e1fd0098aab07fe3c86
SHA1ff8d484c90feab90b94502fbcaff84b16eb9a280
SHA2561e0fc6cf4d0b655fc2495aeb3890f382e00ec9060ab23fa0a035a5042cda6daa
SHA512888e8d2f20ccf440107971e8268d06b34aa8c7e5c476f55544321780f30af52c731ada5cca83f015b607f3b61dc5be276199a9dd3cc50fd70ed47c38ca5495cd
-
memory/1796-0-0x0000000000290000-0x000000000029C000-memory.dmpFilesize
48KB
-
memory/1796-4-0x0000000000280000-0x000000000028A000-memory.dmpFilesize
40KB
-
memory/2564-14-0x00000000002E0000-0x00000000002EC000-memory.dmpFilesize
48KB
-
memory/2564-18-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB