Analysis
-
max time kernel
126s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 20:24
Static task
static1
Behavioral task
behavioral1
Sample
1767290b9606f7dab11712e060849f23_JaffaCakes118.exe
Resource
win7-20240221-en
8 signatures
150 seconds
General
-
Target
1767290b9606f7dab11712e060849f23_JaffaCakes118.exe
-
Size
361KB
-
MD5
1767290b9606f7dab11712e060849f23
-
SHA1
5e5a2c6d905c0e2881fc578c42856fa761970456
-
SHA256
5b75dda7abc71b1156e245a88673cbee40c6a56dc2affa614e984fdcd2f47bda
-
SHA512
857bf6b8fca911a1203e645ddc2ba3390751f63a18397d66037cf7530ebbb17f774a6d08fca5cb472f1a908dac5e13f849d91d948ce44a6cca43c1b8474df07f
-
SSDEEP
6144:xG0fvUDNEuaHP4ccla2laVlaula2la2la2la2larlaBdjAA:xGT5EJHQPaYaLagaYaYaYaYapaN
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
Processes:
guidsguids.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE guidsguids.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies guidsguids.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 guidsguids.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 guidsguids.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
guidsguids.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" guidsguids.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" guidsguids.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix guidsguids.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
guidsguids.exepid process 4756 guidsguids.exe 4756 guidsguids.exe 4756 guidsguids.exe 4756 guidsguids.exe 4756 guidsguids.exe 4756 guidsguids.exe 4756 guidsguids.exe 4756 guidsguids.exe 4756 guidsguids.exe 4756 guidsguids.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
1767290b9606f7dab11712e060849f23_JaffaCakes118.exepid process 2120 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
1767290b9606f7dab11712e060849f23_JaffaCakes118.exeguidsguids.exedescription pid process target process PID 2116 wrote to memory of 2120 2116 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe PID 2116 wrote to memory of 2120 2116 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe PID 2116 wrote to memory of 2120 2116 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe 1767290b9606f7dab11712e060849f23_JaffaCakes118.exe PID 4004 wrote to memory of 4756 4004 guidsguids.exe guidsguids.exe PID 4004 wrote to memory of 4756 4004 guidsguids.exe guidsguids.exe PID 4004 wrote to memory of 4756 4004 guidsguids.exe guidsguids.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1767290b9606f7dab11712e060849f23_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1767290b9606f7dab11712e060849f23_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1767290b9606f7dab11712e060849f23_JaffaCakes118.exe--11da35e22⤵
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\guidsguids.exe"C:\Windows\SysWOW64\guidsguids.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\guidsguids.exe--e81a0f922⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2116-0-0x0000000000600000-0x000000000061B000-memory.dmpFilesize
108KB
-
memory/2116-4-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2116-3-0x0000000000600000-0x000000000061B000-memory.dmpFilesize
108KB
-
memory/2120-5-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2120-11-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/4004-6-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/4756-12-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/4756-13-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/4756-15-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/4756-16-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB