Analysis
- max time kernel
149s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
12/04/2024, 02:48
Behavioral task
behavioral1
Sample
eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe
- Size 766KB
- Sample240412-dae3bagb61
- SHA256 935be617fc1911373a9038096ebd14549fd2ba556a8811ea7215675493ee3d52
- MD5 eef38ff2b21219b04b249bd98806e42b
- SHA1 9d6540f360da22764144bbbf9b92062901bd435f
- SHA512 62768a338c322e2eea84741f3d1947e00639bb4b3778bdf0c68332a2a959fec2c5be363bdcee51cd4c21cb02af15caef1dbf98ff5ff8117e369b36a933d4e66b
- SSDEEP 12288:IfFcGAT79cO2ZKpKHNMF4cDzJRlK2o58u1ij3Z2yL/w0JExcqMd0QZh9u:ypYoZKEMFvDzJqhOuQ5rw0WcD0QZh9u
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\Windupdt\\winupdate.exe" eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe - Executes dropped EXE 1 IoCs
pid Process 2952 winupdate.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\Windupdt\\winupdate.exe" eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\Windupdt\\winupdate.exe" winupdate.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Windupdt\winupdate.exe eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe File opened for modification C:\Windows\Windupdt\ eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe File created C:\Windows\Windupdt\winupdate.exe eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeSecurityPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeSystemtimePrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeBackupPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeRestorePrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeShutdownPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeDebugPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeUndockPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeManageVolumePrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeImpersonatePrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: 33 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: 34 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: 35 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: 36 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2952 winupdate.exe Token: SeSecurityPrivilege 2952 winupdate.exe Token: SeTakeOwnershipPrivilege 2952 winupdate.exe Token: SeLoadDriverPrivilege 2952 winupdate.exe Token: SeSystemProfilePrivilege 2952 winupdate.exe Token: SeSystemtimePrivilege 2952 winupdate.exe Token: SeProfSingleProcessPrivilege 2952 winupdate.exe Token: SeIncBasePriorityPrivilege 2952 winupdate.exe Token: SeCreatePagefilePrivilege 2952 winupdate.exe Token: SeBackupPrivilege 2952 winupdate.exe Token: SeRestorePrivilege 2952 winupdate.exe Token: SeShutdownPrivilege 2952 winupdate.exe Token: SeDebugPrivilege 2952 winupdate.exe Token: SeSystemEnvironmentPrivilege 2952 winupdate.exe Token: SeChangeNotifyPrivilege 2952 winupdate.exe Token: SeRemoteShutdownPrivilege 2952 winupdate.exe Token: SeUndockPrivilege 2952 winupdate.exe Token: SeManageVolumePrivilege 2952 winupdate.exe Token: SeImpersonatePrivilege 2952 winupdate.exe Token: SeCreateGlobalPrivilege 2952 winupdate.exe Token: 33 2952 winupdate.exe Token: 34 2952 winupdate.exe Token: 35 2952 winupdate.exe Token: 36 2952 winupdate.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2952 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe 83 PID 1968 wrote to memory of 2952 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe 83 PID 1968 wrote to memory of 2952 1968 eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe 83 PID 2952 wrote to memory of 4188 2952 winupdate.exe 84 PID 2952 wrote to memory of 4188 2952 winupdate.exe 84 PID 2952 wrote to memory of 4188 2952 winupdate.exe 84 PID 2952 wrote to memory of 2968 2952 winupdate.exe 85 PID 2952 wrote to memory of 2968 2952 winupdate.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eef38ff2b21219b04b249bd98806e42b_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\Windupdt\winupdate.exe"C:\Windows\Windupdt\winupdate.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵PID:4188
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵PID:2968
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Windupdt\winupdate.exe
- Size 766KB
- SHA256 935be617fc1911373a9038096ebd14549fd2ba556a8811ea7215675493ee3d52
- MD5 eef38ff2b21219b04b249bd98806e42b
- SHA1 9d6540f360da22764144bbbf9b92062901bd435f
- SHA512 62768a338c322e2eea84741f3d1947e00639bb4b3778bdf0c68332a2a959fec2c5be363bdcee51cd4c21cb02af15caef1dbf98ff5ff8117e369b36a933d4e66b
- SSDEEP 12288:IfFcGAT79cO2ZKpKHNMF4cDzJRlK2o58u1ij3Z2yL/w0JExcqMd0QZh9u:ypYoZKEMFvDzJqhOuQ5rw0WcD0QZh9u
- MD5 SHA1 SHA512 SSDEEP