Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 23:25
Static task
static1
Behavioral task
behavioral1
Sample
e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe
-
Size
273KB
-
MD5
e61afa2a7110f1a61e538b3e20c0708e
-
SHA1
dc368a0e9dc02a2091d13c6c4c68ec1300df35f4
-
SHA256
53c36808f6d8c6ed26b2d2494cab0d5976c792d6bae2120c8a27a5149d27e94c
-
SHA512
fbdc3058838842e8c0d150bd75386571f87ad5dffa047922e057feed85f4b725ae3955fc9d8c75117f1eb1e71745bd1e79ce76ccb486dc0c995af946fb4a7bca
-
SSDEEP
6144:5Q+7l60LCYhb9XlIToRWyGm1f8czjOXNbYAIzwyPqX:blhXJX6oGm1f3jGbIMIK
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe -
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
9157.tmppid process 648 9157.tmp -
Loads dropped DLL 2 IoCs
Processes:
e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exepid process 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2040-1-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2040-14-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2164-12-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2040-122-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/648-125-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/648-124-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2040-297-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2040-303-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DCD.exe = "C:\\Program Files (x86)\\LP\\66EC\\DCD.exe" e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
Processes:
e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exedescription ioc process File created C:\Program Files (x86)\LP\66EC\DCD.exe e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\66EC\DCD.exe e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\66EC\9157.tmp e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exepid process 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 892 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
msiexec.exeexplorer.exedescription pid process Token: SeRestorePrivilege 2124 msiexec.exe Token: SeTakeOwnershipPrivilege 2124 msiexec.exe Token: SeSecurityPrivilege 2124 msiexec.exe Token: SeShutdownPrivilege 892 explorer.exe Token: SeShutdownPrivilege 892 explorer.exe Token: SeShutdownPrivilege 892 explorer.exe Token: SeShutdownPrivilege 892 explorer.exe Token: SeShutdownPrivilege 892 explorer.exe Token: SeShutdownPrivilege 892 explorer.exe Token: SeShutdownPrivilege 892 explorer.exe Token: SeShutdownPrivilege 892 explorer.exe Token: SeShutdownPrivilege 892 explorer.exe Token: SeShutdownPrivilege 892 explorer.exe Token: SeShutdownPrivilege 892 explorer.exe Token: SeShutdownPrivilege 892 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
explorer.exepid process 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
explorer.exepid process 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe 892 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exedescription pid process target process PID 2040 wrote to memory of 2164 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe PID 2040 wrote to memory of 2164 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe PID 2040 wrote to memory of 2164 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe PID 2040 wrote to memory of 2164 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe PID 2040 wrote to memory of 648 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe PID 2040 wrote to memory of 648 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe PID 2040 wrote to memory of 648 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe PID 2040 wrote to memory of 648 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe PID 2040 wrote to memory of 648 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 9157.tmp PID 2040 wrote to memory of 648 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 9157.tmp PID 2040 wrote to memory of 648 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 9157.tmp PID 2040 wrote to memory of 648 2040 e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe 9157.tmp -
System policy modification 1 TTPs 2 IoCs
Processes:
e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\CFE00\CA366.exe%C:\Users\Admin\AppData\Roaming\CFE002⤵PID:2164
-
-
C:\Users\Admin\AppData\Local\Temp\e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e61afa2a7110f1a61e538b3e20c0708e_JaffaCakes118.exe startC:\Program Files (x86)\00943\lvvm.exe%C:\Program Files (x86)\009432⤵PID:648
-
-
C:\Program Files (x86)\LP\66EC\9157.tmp"C:\Program Files (x86)\LP\66EC\9157.tmp"2⤵
- Executes dropped EXE
PID:648
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:892
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD52cfaa86e22fb567d54508b9ea9114c30
SHA19cd53db30affbf14ce1afcebff2f1f2adf3ef69a
SHA2568e49317ec427af27f2bdaefd6b9e3ef4dc2452017855b0c885ae42cf1ec9b6b6
SHA512d82e598bdf1deb9eb8ebae0c5db0980702a0f9d35f43d9f8d469356c9187ab751464de157fb927c373fea27c5bb77134c340f648cb20a39844f2c7d1df803c6e
-
Filesize
600B
MD53a403f1fb6a23a8767b90c20a7db3173
SHA10f93248add548dae3083d97abcfa8759d59a7a40
SHA256ea5c859318a981d25e40f50c358490d52ddb245dd41aa6c64c5297776140d4a9
SHA512daa17237df1a2480f16af13832b44f6bf499f4c48886e560bc625ced3eeea50127bb85c1131b31f60b832419da61713ce14a6d74b2a3cff252f8f8f4453cd5c1
-
Filesize
1KB
MD5369d1733362e9735650d5c1f7c87177c
SHA14726d5b675b739ba62a675a39727c8d5cf5e3570
SHA256510a41cf0b84b60a40997d42653b6f51947edfbc0ba254d561a8b8b19131337e
SHA512f795a895f11ca3a628142a94452837d953b6602d78ecfe86e1c56c76fa1e2a2752449f7a4279e69e56477b40680c89ebfc04cb09733ad4c1f14ea424ae2a5904
-
Filesize
300B
MD571ea220bb596667539770f4978f0d44d
SHA15e5bbf31e8c54848589af4f6207bfa6d3decd182
SHA256c05d25caf8f42b0fef8110e0eb27269d21666971c6ef21c77d4cd4423e7a858f
SHA5129237857b5fc2d5b7d147cd4d2e761309a3648ddc9958e8bad5467027f6baf5d70dbdc602baa3fa47202929ce7cc114838ed54733d1ee644fc774b86d6e114f26
-
Filesize
96KB
MD574a1e9547eb8c42e9ca482c5c8bdd261
SHA1c56c60e84b4ef45065289636cfdfab21654acdb3
SHA256f4ac8ead1ff2f95c2b50405531d433d7af912b8f848095d3cb00401576ee90fb
SHA512ae90627a5f1485383b6de178aea4b36f9e44891d78fe5a274d1632727dd71906061323725a7c3c106b039cb65e10ea7e9c7d277ce35fb0ac6458fdc3e346ecb9