Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
14-04-2024 22:41
Behavioral task
behavioral1
Sample
efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe
-
Size
3.8MB
-
MD5
efae2dc9c812edcd76426579e516c7d3
-
SHA1
df8acdef44d958bcec5fb64757a554cfa5bc5f14
-
SHA256
03e15b7644a4692524bd1e5e41cb22921a5bec52191d390160b0d6de61940cdd
-
SHA512
07bb99811d17b84ab5a11903f8623d8d84eb6e2063210630fcaa7d6fc3006317572846167e10c36f75b22ced12ac99f33f0911f87eff48fc4e7f5f2fbaf8f5ac
-
SSDEEP
98304:vJwakG4fYrq1HJvpliCQHawbzBbGSlaUEI96kdQDanpqHrO3ndI3/lL/v7zVwwX/:vJwakG4fYrq1HJvpliCQHawbzBbGSlah
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
mcsft.exemcsft.exepid process 3532 mcsft.exe 4016 mcsft.exe -
Processes:
resource yara_rule behavioral2/memory/3552-0-0x0000000000400000-0x00000000007C9000-memory.dmp upx C:\Users\Admin\AppData\Roaming\mcsft.txt upx behavioral2/memory/3552-29-0x0000000000400000-0x00000000007C9000-memory.dmp upx behavioral2/memory/4016-31-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4016-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4016-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3532-36-0x0000000000400000-0x00000000007C9000-memory.dmp upx behavioral2/memory/4016-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4016-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4016-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4016-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4016-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4016-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4016-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4016-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4016-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4016-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4016-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4016-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mcsft.exedescription pid process target process PID 3532 set thread context of 4016 3532 mcsft.exe mcsft.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
mcsft.exedescription pid process Token: SeIncreaseQuotaPrivilege 4016 mcsft.exe Token: SeSecurityPrivilege 4016 mcsft.exe Token: SeTakeOwnershipPrivilege 4016 mcsft.exe Token: SeLoadDriverPrivilege 4016 mcsft.exe Token: SeSystemProfilePrivilege 4016 mcsft.exe Token: SeSystemtimePrivilege 4016 mcsft.exe Token: SeProfSingleProcessPrivilege 4016 mcsft.exe Token: SeIncBasePriorityPrivilege 4016 mcsft.exe Token: SeCreatePagefilePrivilege 4016 mcsft.exe Token: SeBackupPrivilege 4016 mcsft.exe Token: SeRestorePrivilege 4016 mcsft.exe Token: SeShutdownPrivilege 4016 mcsft.exe Token: SeDebugPrivilege 4016 mcsft.exe Token: SeSystemEnvironmentPrivilege 4016 mcsft.exe Token: SeChangeNotifyPrivilege 4016 mcsft.exe Token: SeRemoteShutdownPrivilege 4016 mcsft.exe Token: SeUndockPrivilege 4016 mcsft.exe Token: SeManageVolumePrivilege 4016 mcsft.exe Token: SeImpersonatePrivilege 4016 mcsft.exe Token: SeCreateGlobalPrivilege 4016 mcsft.exe Token: 33 4016 mcsft.exe Token: 34 4016 mcsft.exe Token: 35 4016 mcsft.exe Token: 36 4016 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exemcsft.exemcsft.exepid process 3552 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe 3532 mcsft.exe 4016 mcsft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.execmd.exemcsft.exedescription pid process target process PID 3552 wrote to memory of 4868 3552 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe cmd.exe PID 3552 wrote to memory of 4868 3552 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe cmd.exe PID 3552 wrote to memory of 4868 3552 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe cmd.exe PID 4868 wrote to memory of 752 4868 cmd.exe reg.exe PID 4868 wrote to memory of 752 4868 cmd.exe reg.exe PID 4868 wrote to memory of 752 4868 cmd.exe reg.exe PID 3552 wrote to memory of 3532 3552 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe mcsft.exe PID 3552 wrote to memory of 3532 3552 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe mcsft.exe PID 3552 wrote to memory of 3532 3552 efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe mcsft.exe PID 3532 wrote to memory of 4016 3532 mcsft.exe mcsft.exe PID 3532 wrote to memory of 4016 3532 mcsft.exe mcsft.exe PID 3532 wrote to memory of 4016 3532 mcsft.exe mcsft.exe PID 3532 wrote to memory of 4016 3532 mcsft.exe mcsft.exe PID 3532 wrote to memory of 4016 3532 mcsft.exe mcsft.exe PID 3532 wrote to memory of 4016 3532 mcsft.exe mcsft.exe PID 3532 wrote to memory of 4016 3532 mcsft.exe mcsft.exe PID 3532 wrote to memory of 4016 3532 mcsft.exe mcsft.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\efae2dc9c812edcd76426579e516c7d3_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dBPqZ.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
PID:752 -
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
3.8MB
MD51bb341e66a119c572c8e5ea24b2e5063
SHA129c93632c1d0fc753f34b82bcb8cb58ef3574228
SHA25683c2a7e78fa7fa9fe1e17e4c6a46da423401f9e67f600a3ddf5d4bd8f3ec7699
SHA5121efc71079ef8150271cd6a3cf3ed60c68074da2a1de923e77ac112ade22378a1757f1c6c57d8563f5f8e43ca3cbd877f6d74a45473b22d42d9310d7309e7ff9d