Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 20:42
Static task
static1
Behavioral task
behavioral1
Sample
7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe
-
Size
321KB
-
MD5
7a76310e8ed433e10ddba6b898340240
-
SHA1
c2e1790dd0ccdb180f43a9cecfd2609883b0b98d
-
SHA256
9560685c75f98ab9a01e5f272208db8816e88da4218ee87ca8a0b678f8e385ae
-
SHA512
b0803a82e520fe27286f550d102c26dba1e84fce450577ea54b4c7e76a5dabf7ff48863a26bdd45f14bc0021c8602272b3f4d6887028b07fdb848fa61fcb749a
-
SSDEEP
6144:u4nby/WmbAC/ACtuQLlEXGQfsQmblf3QtPvlPObfjwWno0k2HP:u4nG8vMFEXZsJxYtHyQNoP
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2580 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
7a76310e8ed433e10ddba6b898340240_jaffacakes118.exepid process 2668 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe -
Loads dropped DLL 2 IoCs
Processes:
7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exepid process 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7a76310e8ed433e10ddba6b898340240_jaffacakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchosl = "C:\\Users\\Admin\\AppData\\Roaming\\svchosl\\svchosl.exe" 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe7a76310e8ed433e10ddba6b898340240_jaffacakes118.exepid process 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe 2668 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe 2668 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe 2668 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe 2668 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe 2668 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7a76310e8ed433e10ddba6b898340240_jaffacakes118.exepid process 2668 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe7a76310e8ed433e10ddba6b898340240_jaffacakes118.exedescription pid process Token: SeDebugPrivilege 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe Token: SeDebugPrivilege 2668 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe Token: 33 2668 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe Token: SeIncBasePriorityPrivilege 2668 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
7a76310e8ed433e10ddba6b898340240_jaffacakes118.exepid process 2668 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7a76310e8ed433e10ddba6b898340240_JaffaCakes118.execmd.exedescription pid process target process PID 1652 wrote to memory of 2668 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe PID 1652 wrote to memory of 2668 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe PID 1652 wrote to memory of 2668 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe PID 1652 wrote to memory of 2668 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe 7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe PID 1652 wrote to memory of 2580 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe cmd.exe PID 1652 wrote to memory of 2580 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe cmd.exe PID 1652 wrote to memory of 2580 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe cmd.exe PID 1652 wrote to memory of 2580 1652 7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe cmd.exe PID 2580 wrote to memory of 2844 2580 cmd.exe PING.EXE PID 2580 wrote to memory of 2844 2580 cmd.exe PING.EXE PID 2580 wrote to memory of 2844 2580 cmd.exe PING.EXE PID 2580 wrote to memory of 2844 2580 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7a76310e8ed433e10ddba6b898340240_jaffacakes118\7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\7a76310e8ed433e10ddba6b898340240_jaffacakes118\7a76310e8ed433e10ddba6b898340240_jaffacakes118.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\7a76310e8ed433e10ddba6b898340240_JaffaCakes118.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Imminent\Path.datFilesize
50B
MD567b1152e9924eb00ecadeb2721d435df
SHA164b78a5bd36d5bc3a68191ad06b1cbad44d3cd90
SHA2567966bc0ae95d7a88e4463713086c0676f54d5501d17e5ebc30a3cfa5835e49e8
SHA51214c8f6135cd48e361fa9d32f8f31f4698f24b8a36560002ae987898954a5809b6ac50fa08e20734002eb47cd51cd182df15fafbb630cd0f1d4022c4590d4fd62
-
\Users\Admin\AppData\Local\Temp\7a76310e8ed433e10ddba6b898340240_jaffacakes118\7a76310e8ed433e10ddba6b898340240_jaffacakes118.exeFilesize
321KB
MD57a76310e8ed433e10ddba6b898340240
SHA1c2e1790dd0ccdb180f43a9cecfd2609883b0b98d
SHA2569560685c75f98ab9a01e5f272208db8816e88da4218ee87ca8a0b678f8e385ae
SHA512b0803a82e520fe27286f550d102c26dba1e84fce450577ea54b4c7e76a5dabf7ff48863a26bdd45f14bc0021c8602272b3f4d6887028b07fdb848fa61fcb749a
-
memory/1652-0-0x00000000743D1000-0x00000000743D2000-memory.dmpFilesize
4KB
-
memory/1652-1-0x00000000743D0000-0x000000007497B000-memory.dmpFilesize
5.7MB
-
memory/1652-2-0x00000000743D0000-0x000000007497B000-memory.dmpFilesize
5.7MB
-
memory/1652-15-0x00000000743D0000-0x000000007497B000-memory.dmpFilesize
5.7MB
-
memory/2668-14-0x00000000743D0000-0x000000007497B000-memory.dmpFilesize
5.7MB
-
memory/2668-13-0x00000000743D0000-0x000000007497B000-memory.dmpFilesize
5.7MB
-
memory/2668-38-0x00000000743D0000-0x000000007497B000-memory.dmpFilesize
5.7MB
-
memory/2668-44-0x00000000743D0000-0x000000007497B000-memory.dmpFilesize
5.7MB