Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 20:24
Static task
static1
Behavioral task
behavioral1
Sample
1767290b9606f7dab11712e060849f23_JaffaCakes118.exe
Resource
win7-20240221-en
8 signatures
150 seconds
General
-
Target
1767290b9606f7dab11712e060849f23_JaffaCakes118.exe
-
Size
361KB
-
MD5
1767290b9606f7dab11712e060849f23
-
SHA1
5e5a2c6d905c0e2881fc578c42856fa761970456
-
SHA256
5b75dda7abc71b1156e245a88673cbee40c6a56dc2affa614e984fdcd2f47bda
-
SHA512
857bf6b8fca911a1203e645ddc2ba3390751f63a18397d66037cf7530ebbb17f774a6d08fca5cb472f1a908dac5e13f849d91d948ce44a6cca43c1b8474df07f
-
SSDEEP
6144:xG0fvUDNEuaHP4ccla2laVlaula2la2la2la2larlaBdjAA:xGT5EJHQPaYaLagaYaYaYaYapaN
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
isssubs.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat isssubs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
isssubs.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix isssubs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" isssubs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings isssubs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" isssubs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-3f-c6-c4-4b-fd isssubs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-3f-c6-c4-4b-fd\WpadDecisionTime = b00f5728d0c8da01 isssubs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections isssubs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0116000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 isssubs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DB0A02AF-0661-40D9-A76D-C04CBED38BDC}\WpadDecision = "0" isssubs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings isssubs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 isssubs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad isssubs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DB0A02AF-0661-40D9-A76D-C04CBED38BDC} isssubs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DB0A02AF-0661-40D9-A76D-C04CBED38BDC}\WpadDecisionReason = "1" isssubs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DB0A02AF-0661-40D9-A76D-C04CBED38BDC}\WpadDecisionTime = b00f5728d0c8da01 isssubs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DB0A02AF-0661-40D9-A76D-C04CBED38BDC}\WpadNetworkName = "Network 3" isssubs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DB0A02AF-0661-40D9-A76D-C04CBED38BDC}\aa-3f-c6-c4-4b-fd isssubs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 isssubs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" isssubs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-3f-c6-c4-4b-fd\WpadDecisionReason = "1" isssubs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-3f-c6-c4-4b-fd\WpadDecision = "0" isssubs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
isssubs.exepid process 2612 isssubs.exe 2612 isssubs.exe 2612 isssubs.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
1767290b9606f7dab11712e060849f23_JaffaCakes118.exepid process 2724 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
1767290b9606f7dab11712e060849f23_JaffaCakes118.exe1767290b9606f7dab11712e060849f23_JaffaCakes118.exeisssubs.exeisssubs.exepid process 996 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe 2724 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe 2600 isssubs.exe 2612 isssubs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1767290b9606f7dab11712e060849f23_JaffaCakes118.exeisssubs.exedescription pid process target process PID 996 wrote to memory of 2724 996 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe PID 996 wrote to memory of 2724 996 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe PID 996 wrote to memory of 2724 996 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe PID 996 wrote to memory of 2724 996 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe PID 2600 wrote to memory of 2612 2600 isssubs.exe isssubs.exe PID 2600 wrote to memory of 2612 2600 isssubs.exe isssubs.exe PID 2600 wrote to memory of 2612 2600 isssubs.exe isssubs.exe PID 2600 wrote to memory of 2612 2600 isssubs.exe isssubs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1767290b9606f7dab11712e060849f23_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1767290b9606f7dab11712e060849f23_JaffaCakes118.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1767290b9606f7dab11712e060849f23_JaffaCakes118.exe--11da35e22⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\isssubs.exe"C:\Windows\SysWOW64\isssubs.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\isssubs.exe--d1b276b22⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/996-0-0x00000000002A0000-0x00000000002BB000-memory.dmpFilesize
108KB
-
memory/996-2-0x00000000002A0000-0x00000000002BB000-memory.dmpFilesize
108KB
-
memory/996-3-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2600-6-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2612-10-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2612-11-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2612-12-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2612-13-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2724-4-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2724-5-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2724-9-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB