Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 07:30
Static task
static1
Behavioral task
behavioral1
Sample
f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
f093f75b0c4fb499e79407a6f1e0677b
-
SHA1
4c49a59b3723aef75f7dbb1270151112cc844c7e
-
SHA256
7c313a9892feb0bd975f6d8c1fe9ea0447adbf738c88353236079693046bb4d8
-
SHA512
5034c1fab191f226aaa82f3f44b31d34f078c7aee2027f70a02cf6acb6db239311df60deacf19c1b798a658e4fdf775b4bbd67b0ba813357dc49f8247b7a1a68
-
SSDEEP
12288:A5fQl3fYNmFm4ODd6spRXLh2pBHMP4KSt9043Q5yzYtS5Ur8bmFzujLRI4LZJZjE:DvYRRLpNAttTXgVan
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\WinDir\\Svchost.exe" vbc.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vbc.exe -
Executes dropped EXE 1 IoCs
Processes:
Svchost.exepid process 5096 Svchost.exe -
Processes:
resource yara_rule behavioral2/memory/3216-4-0x0000000000400000-0x00000000004E6000-memory.dmp upx behavioral2/memory/3216-7-0x0000000000400000-0x00000000004E6000-memory.dmp upx behavioral2/memory/3216-10-0x0000000000400000-0x00000000004E6000-memory.dmp upx behavioral2/memory/3216-9-0x0000000000400000-0x00000000004E6000-memory.dmp upx behavioral2/memory/3216-12-0x0000000000400000-0x00000000004E6000-memory.dmp upx behavioral2/memory/3216-72-0x0000000000400000-0x00000000004E6000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exevbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\"" f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Svchost = "C:\\Windows\\WinDir\\Svchost.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exedescription pid process target process PID 3016 set thread context of 3216 3016 f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe vbc.exe -
Drops file in Windows directory 3 IoCs
Processes:
vbc.exedescription ioc process File created C:\Windows\WinDir\Svchost.exe vbc.exe File opened for modification C:\Windows\WinDir\Svchost.exe vbc.exe File opened for modification C:\Windows\WinDir\ vbc.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier vbc.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier vbc.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier vbc.exe -
Modifies registry class 1 IoCs
Processes:
vbc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ vbc.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 3216 vbc.exe Token: SeSecurityPrivilege 3216 vbc.exe Token: SeTakeOwnershipPrivilege 3216 vbc.exe Token: SeLoadDriverPrivilege 3216 vbc.exe Token: SeSystemProfilePrivilege 3216 vbc.exe Token: SeSystemtimePrivilege 3216 vbc.exe Token: SeProfSingleProcessPrivilege 3216 vbc.exe Token: SeIncBasePriorityPrivilege 3216 vbc.exe Token: SeCreatePagefilePrivilege 3216 vbc.exe Token: SeBackupPrivilege 3216 vbc.exe Token: SeRestorePrivilege 3216 vbc.exe Token: SeShutdownPrivilege 3216 vbc.exe Token: SeDebugPrivilege 3216 vbc.exe Token: SeSystemEnvironmentPrivilege 3216 vbc.exe Token: SeChangeNotifyPrivilege 3216 vbc.exe Token: SeRemoteShutdownPrivilege 3216 vbc.exe Token: SeUndockPrivilege 3216 vbc.exe Token: SeManageVolumePrivilege 3216 vbc.exe Token: SeImpersonatePrivilege 3216 vbc.exe Token: SeCreateGlobalPrivilege 3216 vbc.exe Token: 33 3216 vbc.exe Token: 34 3216 vbc.exe Token: 35 3216 vbc.exe Token: 36 3216 vbc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exevbc.exedescription pid process target process PID 3016 wrote to memory of 3216 3016 f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 3216 3016 f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 3216 3016 f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 3216 3016 f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 3216 3016 f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 3216 3016 f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 3216 3016 f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe vbc.exe PID 3016 wrote to memory of 3216 3016 f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe vbc.exe PID 3216 wrote to memory of 2720 3216 vbc.exe explorer.exe PID 3216 wrote to memory of 2720 3216 vbc.exe explorer.exe PID 3216 wrote to memory of 2720 3216 vbc.exe explorer.exe PID 3216 wrote to memory of 5096 3216 vbc.exe Svchost.exe PID 3216 wrote to memory of 5096 3216 vbc.exe Svchost.exe PID 3216 wrote to memory of 5096 3216 vbc.exe Svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f093f75b0c4fb499e79407a6f1e0677b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵PID:2720
-
C:\Windows\WinDir\Svchost.exe"C:\Windows\WinDir\Svchost.exe"3⤵
- Executes dropped EXE
PID:5096
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵PID:1640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34