Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 03:15
Static task
static1
Behavioral task
behavioral1
Sample
fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe
-
Size
34KB
-
MD5
fbce6c0b48a1efa5dd16b214cfaea912
-
SHA1
65bcf4938a03222be7115ad0107849464092e22b
-
SHA256
aeab1db1d5a31de069439186f309cf6994d546ed700834d7517facfb128046c4
-
SHA512
26c4e9113253b4389e53d550f9652a8713f5d0a2fbd65a4c1b8c5aca454352fd3ddb298b1dd4613cab55fd9d89c9bf0efa2129ad8052e6c23d9cbe4433f19dcf
-
SSDEEP
768:60tZgEXGiDC/FzLzP1eAEV3ezUKi8io4NY0u0s1j8O6hoob:60kl8ClLD1eAEszPim4NTrsx6Gy
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1448 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
wuaucldt.exewuaucldt.exepid process 2820 wuaucldt.exe 2572 wuaucldt.exe -
Loads dropped DLL 4 IoCs
Processes:
fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exewuaucldt.exepid process 2372 fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe 2372 fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe 2820 wuaucldt.exe 2820 wuaucldt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wuaucldt.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\windows\\system32\\wuaucldt.exe" wuaucldt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\users\\admin\\wuaucldt.exe" wuaucldt.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
svchost.exedescription ioc process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 2 IoCs
Processes:
wuaucldt.exefbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exedescription ioc process File created \??\c:\windows\SysWOW64\wuaucldt.exe wuaucldt.exe File created \??\c:\windows\SysWOW64\wuaucldt.exe fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wuaucldt.exedescription pid process target process PID 2572 set thread context of 2612 2572 wuaucldt.exe svchost.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exewuaucldt.exewuaucldt.exedescription pid process target process PID 2372 wrote to memory of 2820 2372 fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe wuaucldt.exe PID 2372 wrote to memory of 2820 2372 fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe wuaucldt.exe PID 2372 wrote to memory of 2820 2372 fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe wuaucldt.exe PID 2372 wrote to memory of 2820 2372 fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe wuaucldt.exe PID 2820 wrote to memory of 2572 2820 wuaucldt.exe wuaucldt.exe PID 2820 wrote to memory of 2572 2820 wuaucldt.exe wuaucldt.exe PID 2820 wrote to memory of 2572 2820 wuaucldt.exe wuaucldt.exe PID 2820 wrote to memory of 2572 2820 wuaucldt.exe wuaucldt.exe PID 2572 wrote to memory of 2612 2572 wuaucldt.exe svchost.exe PID 2572 wrote to memory of 2612 2572 wuaucldt.exe svchost.exe PID 2572 wrote to memory of 2612 2572 wuaucldt.exe svchost.exe PID 2572 wrote to memory of 2612 2572 wuaucldt.exe svchost.exe PID 2572 wrote to memory of 2612 2572 wuaucldt.exe svchost.exe PID 2572 wrote to memory of 2612 2572 wuaucldt.exe svchost.exe PID 2372 wrote to memory of 1448 2372 fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe cmd.exe PID 2372 wrote to memory of 1448 2372 fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe cmd.exe PID 2372 wrote to memory of 1448 2372 fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe cmd.exe PID 2372 wrote to memory of 1448 2372 fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe cmd.exe PID 2820 wrote to memory of 2940 2820 wuaucldt.exe cmd.exe PID 2820 wrote to memory of 2940 2820 wuaucldt.exe cmd.exe PID 2820 wrote to memory of 2940 2820 wuaucldt.exe cmd.exe PID 2820 wrote to memory of 2940 2820 wuaucldt.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fbce6c0b48a1efa5dd16b214cfaea912_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\wuaucldt.exec:\windows\system32\wuaucldt.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\wuaucldt.exec:\users\admin\wuaucldt.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\windows\syswow64\wuaucldt.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\users\admin\appdata\local\temp\FBCE6C~1.EXE2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\SysWOW64\wuaucldt.exeFilesize
34KB
MD5fbce6c0b48a1efa5dd16b214cfaea912
SHA165bcf4938a03222be7115ad0107849464092e22b
SHA256aeab1db1d5a31de069439186f309cf6994d546ed700834d7517facfb128046c4
SHA51226c4e9113253b4389e53d550f9652a8713f5d0a2fbd65a4c1b8c5aca454352fd3ddb298b1dd4613cab55fd9d89c9bf0efa2129ad8052e6c23d9cbe4433f19dcf
-
memory/2372-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2372-1-0x0000000009000000-0x0000000009009000-memory.dmpFilesize
36KB
-
memory/2372-3-0x0000000070000000-0x000000007000B000-memory.dmpFilesize
44KB
-
memory/2372-2-0x0000000009000000-0x0000000009009000-memory.dmpFilesize
36KB
-
memory/2372-7-0x0000000000420000-0x000000000042B000-memory.dmpFilesize
44KB
-
memory/2372-14-0x0000000000420000-0x000000000042B000-memory.dmpFilesize
44KB
-
memory/2372-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2612-30-0x00000000000C0000-0x00000000000C9000-memory.dmpFilesize
36KB
-
memory/2612-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2612-33-0x00000000000C0000-0x00000000000C9000-memory.dmpFilesize
36KB
-
memory/2612-35-0x00000000000C0000-0x00000000000C9000-memory.dmpFilesize
36KB
-
memory/2612-36-0x00000000000C0000-0x00000000000C9000-memory.dmpFilesize
36KB
-
memory/2612-39-0x00000000000C0000-0x00000000000C9000-memory.dmpFilesize
36KB
-
memory/2612-40-0x00000000000C0000-0x00000000000C9000-memory.dmpFilesize
36KB
-
memory/2820-16-0x0000000070000000-0x000000007000B000-memory.dmpFilesize
44KB