Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
14-04-2024 22:41
Behavioral task
behavioral1
Sample
efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe
-
Size
3.8MB
-
MD5
efae2dc9c812edcd76426579e516c7d3
-
SHA1
df8acdef44d958bcec5fb64757a554cfa5bc5f14
-
SHA256
03e15b7644a4692524bd1e5e41cb22921a5bec52191d390160b0d6de61940cdd
-
SHA512
07bb99811d17b84ab5a11903f8623d8d84eb6e2063210630fcaa7d6fc3006317572846167e10c36f75b22ced12ac99f33f0911f87eff48fc4e7f5f2fbaf8f5ac
-
SSDEEP
98304:vJwakG4fYrq1HJvpliCQHawbzBbGSlaUEI96kdQDanpqHrO3ndI3/lL/v7zVwwX/:vJwakG4fYrq1HJvpliCQHawbzBbGSlah
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Executes dropped EXE 2 IoCs
Processes:
mcsft.exemcsft.exepid process 2684 mcsft.exe 2808 mcsft.exe -
Loads dropped DLL 6 IoCs
Processes:
efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exemcsft.exepid process 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe 2684 mcsft.exe -
Processes:
resource yara_rule behavioral1/memory/2516-0-0x0000000000400000-0x00000000007C9000-memory.dmp upx C:\Users\Admin\AppData\Roaming\mcsft.exe upx behavioral1/memory/2516-46-0x0000000000400000-0x00000000007C9000-memory.dmp upx behavioral1/memory/2684-48-0x0000000000400000-0x00000000007C9000-memory.dmp upx behavioral1/memory/2684-52-0x0000000002AD0000-0x0000000002E99000-memory.dmp upx behavioral1/memory/2808-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2808-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2684-56-0x0000000000400000-0x00000000007C9000-memory.dmp upx behavioral1/memory/2808-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2808-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2808-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2808-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2808-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2808-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2808-66-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2808-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2808-71-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2808-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2808-75-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2808-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2808-80-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mcsft.exedescription pid process target process PID 2684 set thread context of 2808 2684 mcsft.exe mcsft.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
mcsft.exedescription pid process Token: SeIncreaseQuotaPrivilege 2808 mcsft.exe Token: SeSecurityPrivilege 2808 mcsft.exe Token: SeTakeOwnershipPrivilege 2808 mcsft.exe Token: SeLoadDriverPrivilege 2808 mcsft.exe Token: SeSystemProfilePrivilege 2808 mcsft.exe Token: SeSystemtimePrivilege 2808 mcsft.exe Token: SeProfSingleProcessPrivilege 2808 mcsft.exe Token: SeIncBasePriorityPrivilege 2808 mcsft.exe Token: SeCreatePagefilePrivilege 2808 mcsft.exe Token: SeBackupPrivilege 2808 mcsft.exe Token: SeRestorePrivilege 2808 mcsft.exe Token: SeShutdownPrivilege 2808 mcsft.exe Token: SeDebugPrivilege 2808 mcsft.exe Token: SeSystemEnvironmentPrivilege 2808 mcsft.exe Token: SeChangeNotifyPrivilege 2808 mcsft.exe Token: SeRemoteShutdownPrivilege 2808 mcsft.exe Token: SeUndockPrivilege 2808 mcsft.exe Token: SeManageVolumePrivilege 2808 mcsft.exe Token: SeImpersonatePrivilege 2808 mcsft.exe Token: SeCreateGlobalPrivilege 2808 mcsft.exe Token: 33 2808 mcsft.exe Token: 34 2808 mcsft.exe Token: 35 2808 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exemcsft.exemcsft.exepid process 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe 2684 mcsft.exe 2808 mcsft.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.execmd.exemcsft.exedescription pid process target process PID 2516 wrote to memory of 3000 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe cmd.exe PID 2516 wrote to memory of 3000 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe cmd.exe PID 2516 wrote to memory of 3000 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe cmd.exe PID 2516 wrote to memory of 3000 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe cmd.exe PID 3000 wrote to memory of 2580 3000 cmd.exe reg.exe PID 3000 wrote to memory of 2580 3000 cmd.exe reg.exe PID 3000 wrote to memory of 2580 3000 cmd.exe reg.exe PID 3000 wrote to memory of 2580 3000 cmd.exe reg.exe PID 2516 wrote to memory of 2684 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe mcsft.exe PID 2516 wrote to memory of 2684 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe mcsft.exe PID 2516 wrote to memory of 2684 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe mcsft.exe PID 2516 wrote to memory of 2684 2516 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe mcsft.exe PID 2684 wrote to memory of 2808 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2808 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2808 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2808 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2808 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2808 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2808 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2808 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2808 2684 mcsft.exe mcsft.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ksUtr.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
PID:2580 -
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
3.8MB
MD5894032fa981350555267f83d9e3bf471
SHA1a72eae9c964de7d553b16cadaa2cccc7a1292a02
SHA256dfa03ea5f47da608468fed069c0707164a2b70ab25fbad145619285ad843bf7e
SHA5120ead4da305bef168f4e8ff09e8de421545958f5ee835f30a64c17a9170e2863f6e2b895a2905fbf82f05ccbc2a2e0f04e70be7eb6e9b604d5af004d5431f4b3e