Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 06:17
Static task
static1
Behavioral task
behavioral1
Sample
5d970965b78013545a9c0d32eb10ee61_JaffaCakes118.vbs
Resource
win7-20240220-en
General
-
Target
5d970965b78013545a9c0d32eb10ee61_JaffaCakes118.vbs
-
Size
22.6MB
-
MD5
5d970965b78013545a9c0d32eb10ee61
-
SHA1
29c055edc3c0de81add7741034f2aa8f038bc638
-
SHA256
50b32f4330ee0822a8010830064aaae8d58a32e556cf77e4dcb624e640ec2234
-
SHA512
a4a344f279c156edc1ed6d5c072962006ab84781f9ed5e3b718d94559c3fb6b6dcdf429020a1458528edd957334c718c7fe641117b5f50fad4a2d18ec5b723a5
-
SSDEEP
12288:/eEl4AjRZrrZTbM6mUnt9Ho3KzA4Gv19yMUq9Rrb8anAO4mrA6DKMjXcZkPSbP6D:3w
Malware Config
Extracted
danabot
181.63.44.194
207.148.83.108
45.77.40.71
87.115.138.169
24.229.48.7
116.111.206.27
45.196.143.203
218.65.3.199
131.59.110.186
113.81.97.96
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2704 2644 regsvr32.exe -
Blocklisted process makes network request 6 IoCs
Processes:
rundll32.exeflow pid process 2 2232 rundll32.exe 3 2232 rundll32.exe 4 2232 rundll32.exe 5 2232 rundll32.exe 8 2232 rundll32.exe 13 2232 rundll32.exe -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exerundll32.exepid process 2504 regsvr32.exe 2232 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WScript.exepid process 2908 WScript.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2704 wrote to memory of 2504 2704 regsvr32.exe regsvr32.exe PID 2704 wrote to memory of 2504 2704 regsvr32.exe regsvr32.exe PID 2704 wrote to memory of 2504 2704 regsvr32.exe regsvr32.exe PID 2704 wrote to memory of 2504 2704 regsvr32.exe regsvr32.exe PID 2704 wrote to memory of 2504 2704 regsvr32.exe regsvr32.exe PID 2704 wrote to memory of 2504 2704 regsvr32.exe regsvr32.exe PID 2704 wrote to memory of 2504 2704 regsvr32.exe regsvr32.exe PID 2504 wrote to memory of 2232 2504 regsvr32.exe rundll32.exe PID 2504 wrote to memory of 2232 2504 regsvr32.exe rundll32.exe PID 2504 wrote to memory of 2232 2504 regsvr32.exe rundll32.exe PID 2504 wrote to memory of 2232 2504 regsvr32.exe rundll32.exe PID 2504 wrote to memory of 2232 2504 regsvr32.exe rundll32.exe PID 2504 wrote to memory of 2232 2504 regsvr32.exe rundll32.exe PID 2504 wrote to memory of 2232 2504 regsvr32.exe rundll32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d970965b78013545a9c0d32eb10ee61_JaffaCakes118.vbs"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\sNKBbUr.txt1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\sNKBbUr.txt2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\sNKBbUr.txt,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\NIRKSG~1.ZIPFilesize
933KB
MD5876ecd68b1b519c3ba5e3c8edb7fa9e2
SHA18ecab84b15e28e251084557365925c386483a1a5
SHA25686841c434c14d073713ecb569e0e54f599be1752a12f89720ebeab3501899cca
SHA51222661ded55ca11cee118256a5b08bb17625955b90f166a153f4f239621a88864d8f30bccdf51850322ad515d3cdfbb6c73520db4d550e2f810087334f942e78b
-
C:\Users\Admin\AppData\Local\Temp\sNKBbUr.txtFilesize
1.1MB
MD5f8cf63fb5f35fb0a72aeffcf1dc27aef
SHA1bcf27f65d35c4ce37f0f6af6ca3f2215fbef34eb
SHA256dca1194d8f8691d90bb209e4b9baae53da4d107169bda9b1d8c4a99a6316b5b9
SHA512f30acf1e157b70df459ef4d133bc680c9a7f48ddd532c29fa9d27c8eb16e976f6baf4d2f701d40a8875929267f8147dc25ee960b8b7eccc20da59eeca814dc4f
-
memory/2232-35-0x00000000020F0000-0x0000000002B1A000-memory.dmpFilesize
10.2MB
-
memory/2232-46-0x00000000020F0000-0x0000000002B1A000-memory.dmpFilesize
10.2MB
-
memory/2232-41-0x00000000020F0000-0x0000000002B1A000-memory.dmpFilesize
10.2MB
-
memory/2232-39-0x00000000020F0000-0x0000000002B1A000-memory.dmpFilesize
10.2MB
-
memory/2232-36-0x00000000020F0000-0x0000000002B1A000-memory.dmpFilesize
10.2MB
-
memory/2232-33-0x00000000020F0000-0x0000000002B1A000-memory.dmpFilesize
10.2MB
-
memory/2504-25-0x0000000002500000-0x0000000002F2A000-memory.dmpFilesize
10.2MB
-
memory/2504-29-0x0000000002500000-0x0000000002F2A000-memory.dmpFilesize
10.2MB
-
memory/2504-28-0x0000000002500000-0x0000000002F2A000-memory.dmpFilesize
10.2MB
-
memory/2504-27-0x0000000002500000-0x0000000002F2A000-memory.dmpFilesize
10.2MB
-
memory/2908-9-0x00000000026A0000-0x00000000026A1000-memory.dmpFilesize
4KB