Analysis
-
max time kernel
54s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 14:00
Behavioral task
behavioral1
Sample
1b9234a7ee3ce4bd4892d7c973ae880b_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1b9234a7ee3ce4bd4892d7c973ae880b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1b9234a7ee3ce4bd4892d7c973ae880b_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
1b9234a7ee3ce4bd4892d7c973ae880b
-
SHA1
98c5885fa2164b7351f7422c40194672aeb20b1a
-
SHA256
ae82443c75b3fa9562cbca7eedd64f119da4ebf354b0818895fab444db1ee192
-
SHA512
d89c82e002e7ef438cfe0a739176d3f2b90650633e6aa0378bf9c7d6c2f1517893aeefed99e0ee14100572f0d1ce58def82ec5b433fef0dc87d62956158f802a
-
SSDEEP
24576:pCS77qIpYuAyckuvMOWd05nK6nf1CbFzWqQJX2rgyOgOemCns1/w:z77qIHNckucYnK6nf1CbFzWqQJXLzgOi
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Output.exepid process 3856 Output.exe -
Processes:
resource yara_rule behavioral2/memory/2956-0-0x0000000001000000-0x00000000011D8000-memory.dmp vmprotect behavioral2/memory/2956-2-0x0000000001000000-0x00000000011D8000-memory.dmp vmprotect behavioral2/memory/2956-11-0x0000000001000000-0x00000000011D8000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1b9234a7ee3ce4bd4892d7c973ae880b_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1b9234a7ee3ce4bd4892d7c973ae880b_JaffaCakes118.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4128 3856 WerFault.exe Output.exe 4272 3856 WerFault.exe Output.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1b9234a7ee3ce4bd4892d7c973ae880b_JaffaCakes118.exedescription pid process target process PID 2956 wrote to memory of 3856 2956 1b9234a7ee3ce4bd4892d7c973ae880b_JaffaCakes118.exe Output.exe PID 2956 wrote to memory of 3856 2956 1b9234a7ee3ce4bd4892d7c973ae880b_JaffaCakes118.exe Output.exe PID 2956 wrote to memory of 3856 2956 1b9234a7ee3ce4bd4892d7c973ae880b_JaffaCakes118.exe Output.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b9234a7ee3ce4bd4892d7c973ae880b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b9234a7ee3ce4bd4892d7c973ae880b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Output.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Output.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 6043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3856 -ip 38561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3856 -ip 38561⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Output.exeFilesize
769KB
MD54e4097692b9714eae6a632cebf45bd73
SHA18c8efdb0cb0490f9e443dac66542ccba72d0b773
SHA256a07dd4b72456c4518bc7098661af7d9cbc2773fe6c6fb1a3dde65f4481f444ab
SHA512f326b5e4f794a418c3b2c221dde04b43789d92197a02757af7a1515b6ec59611ded7f38ed5fb0f0a62490d96f960d05502ec2867654aa8680cf0f65ae8b7ec5a
-
memory/2956-0-0x0000000001000000-0x00000000011D8000-memory.dmpFilesize
1.8MB
-
memory/2956-1-0x00000000011BF000-0x00000000011C0000-memory.dmpFilesize
4KB
-
memory/2956-2-0x0000000001000000-0x00000000011D8000-memory.dmpFilesize
1.8MB
-
memory/2956-11-0x0000000001000000-0x00000000011D8000-memory.dmpFilesize
1.8MB
-
memory/3856-8-0x0000000000010000-0x00000000000D7000-memory.dmpFilesize
796KB
-
memory/3856-9-0x0000000000018000-0x0000000000019000-memory.dmpFilesize
4KB
-
memory/3856-10-0x0000000000010000-0x00000000000D7000-memory.dmpFilesize
796KB