Analysis
- max time kernel
151s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
09/04/2024, 01:15
Behavioral task
behavioral1
Sample
e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe
- Size 2.6MB
- Sample240409-bmntwadc3v
- SHA256 390f84fd669623be495317b65d0593c35ef38988e69cdf06cab5ceb3c3bf15fc
- MD5 e8e10f9d9ac5ea10a165a63e85e4d8d3
- SHA1 9e88371f6ca77a91f2b9f7c3acc88c05ee8b0abd
- SHA512 6c885f07c6cac5802f19392c00ca857eb9f46c85ff3e0e14f395123e2f4d912a42cc413274c6b32d8dd7aea8e315b4fefd19858955068ff61d8609ba0d3d68a7
- SSDEEP 49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99Gf:tKq4oEa9RQs+Cn4/UKf
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe - Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe - Executes dropped EXE 4 IoCs
pid Process 4688 explorer.exe 4656 spoolsv.exe 2872 svchost.exe 4512 spoolsv.exe -
resource yara_rule behavioral2/memory/2724-0-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/files/0x0008000000023213-8.dat themida behavioral2/memory/4688-10-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/files/0x00030000000228bf-15.dat themida behavioral2/memory/4656-19-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/files/0x000e000000023133-26.dat themida behavioral2/memory/2872-28-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/memory/4512-33-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/memory/4512-37-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/memory/4656-38-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/memory/2724-39-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/memory/4688-40-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/memory/4688-41-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/memory/2872-42-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/memory/2872-44-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/memory/2872-50-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/memory/4688-53-0x0000000000400000-0x0000000000A17000-memory.dmp themida behavioral2/memory/4688-55-0x0000000000400000-0x0000000000A17000-memory.dmp themida - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 4688 explorer.exe 4656 spoolsv.exe 2872 svchost.exe 4512 spoolsv.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe 4688 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4688 explorer.exe 2872 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 4688 explorer.exe 4688 explorer.exe 4656 spoolsv.exe 4656 spoolsv.exe 2872 svchost.exe 2872 svchost.exe 4512 spoolsv.exe 4512 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2724 wrote to memory of 4688 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 89 PID 2724 wrote to memory of 4688 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 89 PID 2724 wrote to memory of 4688 2724 e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe 89 PID 4688 wrote to memory of 4656 4688 explorer.exe 91 PID 4688 wrote to memory of 4656 4688 explorer.exe 91 PID 4688 wrote to memory of 4656 4688 explorer.exe 91 PID 4656 wrote to memory of 2872 4656 spoolsv.exe 92 PID 4656 wrote to memory of 2872 4656 spoolsv.exe 92 PID 4656 wrote to memory of 2872 4656 spoolsv.exe 92 PID 2872 wrote to memory of 4512 2872 svchost.exe 93 PID 2872 wrote to memory of 4512 2872 svchost.exe 93 PID 2872 wrote to memory of 4512 2872 svchost.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e8e10f9d9ac5ea10a165a63e85e4d8d3_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4512
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 2.6MB
- SHA256 1aba3f24cfc7c12ff1e53839288c1bc3ea3cec579fd116bc478e0474746ce513
- MD5 fb2ac73a5f0a54d5e9b7ebfcf2e99bd2
- SHA1 6325f3d04d591a773809fd957087217d427af38b
- SHA512 376f840a04047e0cbddd17c4793f01f50bb0e500994e02b3c2ab604f64ba6f15462f982e64702c903a2207ab12aff7f60759546aa7dd01b8394530cf4b17342f
- SSDEEP 49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99GE:tKq4oEa9RQs+Cn4/UKE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 2.6MB
- SHA256 d9d80ec74e479b3a87d6f11fd4fab8e90f2e4b955de7bc3615cf1a89d18a8cbd
- MD5 2f5efcba882d6b8fff6920cac8762cfa
- SHA1 c888474659f2538152256d7ef5d1d22db135660e
- SHA512 62242daa1a5d4365161baed828b7e560eac313fdaf2854306f35210caf72317dad806338790efe64bb9d9996b9641ab503687b728379474ca40b2262dd803317
- SSDEEP 49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99Gf:tKq4oEa9RQs+Cn4/UKf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 2.6MB
- SHA256 0bdbe1bcd4b113ed1a08e927331e9769b9cceaa4a2240c637b1b5ed33464058b
- MD5 7c8c4dca694b936789261cce7e0e43a0
- SHA1 1e9ef3f9ab143b5efb015fa19256a0cdb8041296
- SHA512 0f4800eeb717e679ba13262993172fe9864fb9e541842bacef2c4ca660048408079f5bb73e08b7e63e37d6ee338c24011e22a6775ad3cd1b4b791f0b68c0fd17
- SSDEEP 49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99Gw:tKq4oEa9RQs+Cn4/UKw
- MD5 SHA1 SHA512 SSDEEP