Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 06:30
Static task
static1
Behavioral task
behavioral1
Sample
191efde5fff866d11803668bece19481_JaffaCakes118.exe
Resource
win7-20240508-en
8 signatures
150 seconds
General
-
Target
191efde5fff866d11803668bece19481_JaffaCakes118.exe
-
Size
136KB
-
MD5
191efde5fff866d11803668bece19481
-
SHA1
39550c87cfb8a6ebda74bf1af1e7aba1171e1e03
-
SHA256
8b8416fae1cc885453fca2fc5c75576c1a847f0e777845f531ef9e5a7c990e2f
-
SHA512
a88aa1137d2be585e05274a9162c5ba0ffb4b8e88f95bbeb2393a6c5abdc350283270562954a5757b145641e6398bbf6150ec78422504ed99bd0bbb7799bbb54
-
SSDEEP
3072:csTW661letEoocz4plCCCfqBz+Co5wJSg:csTa6EooXCCCfqBz+Cu
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
typbulk.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat typbulk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
typbulk.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings typbulk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections typbulk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" typbulk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-1e-bf-8a-07-66 typbulk.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 typbulk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix typbulk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" typbulk.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4305C44B-8317-442B-AF0B-5F45EE59394D}\WpadDecision = "0" typbulk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4305C44B-8317-442B-AF0B-5F45EE59394D}\WpadNetworkName = "Network 3" typbulk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4305C44B-8317-442B-AF0B-5F45EE59394D}\ee-1e-bf-8a-07-66 typbulk.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-1e-bf-8a-07-66\WpadDecisionTime = 20177cbe24c9da01 typbulk.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" typbulk.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 typbulk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad typbulk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4305C44B-8317-442B-AF0B-5F45EE59394D} typbulk.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4305C44B-8317-442B-AF0B-5F45EE59394D}\WpadDecisionReason = "1" typbulk.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4305C44B-8317-442B-AF0B-5F45EE59394D}\WpadDecisionTime = 20177cbe24c9da01 typbulk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings typbulk.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 typbulk.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-1e-bf-8a-07-66\WpadDecisionReason = "1" typbulk.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-1e-bf-8a-07-66\WpadDecision = "0" typbulk.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
typbulk.exepid process 3044 typbulk.exe 3044 typbulk.exe 3044 typbulk.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
191efde5fff866d11803668bece19481_JaffaCakes118.exepid process 1828 191efde5fff866d11803668bece19481_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
191efde5fff866d11803668bece19481_JaffaCakes118.exe191efde5fff866d11803668bece19481_JaffaCakes118.exetypbulk.exetypbulk.exepid process 1276 191efde5fff866d11803668bece19481_JaffaCakes118.exe 1828 191efde5fff866d11803668bece19481_JaffaCakes118.exe 1152 typbulk.exe 3044 typbulk.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
191efde5fff866d11803668bece19481_JaffaCakes118.exetypbulk.exedescription pid process target process PID 1276 wrote to memory of 1828 1276 191efde5fff866d11803668bece19481_JaffaCakes118.exe 191efde5fff866d11803668bece19481_JaffaCakes118.exe PID 1276 wrote to memory of 1828 1276 191efde5fff866d11803668bece19481_JaffaCakes118.exe 191efde5fff866d11803668bece19481_JaffaCakes118.exe PID 1276 wrote to memory of 1828 1276 191efde5fff866d11803668bece19481_JaffaCakes118.exe 191efde5fff866d11803668bece19481_JaffaCakes118.exe PID 1276 wrote to memory of 1828 1276 191efde5fff866d11803668bece19481_JaffaCakes118.exe 191efde5fff866d11803668bece19481_JaffaCakes118.exe PID 1152 wrote to memory of 3044 1152 typbulk.exe typbulk.exe PID 1152 wrote to memory of 3044 1152 typbulk.exe typbulk.exe PID 1152 wrote to memory of 3044 1152 typbulk.exe typbulk.exe PID 1152 wrote to memory of 3044 1152 typbulk.exe typbulk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\191efde5fff866d11803668bece19481_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\191efde5fff866d11803668bece19481_JaffaCakes118.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\191efde5fff866d11803668bece19481_JaffaCakes118.exe--46b75e72⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\typbulk.exe"C:\Windows\SysWOW64\typbulk.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\typbulk.exe--d32aa5732⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1152-5-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1276-0-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1276-3-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1276-2-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1828-4-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1828-8-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3044-9-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3044-10-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3044-11-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3044-12-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB