Analysis
-
max time kernel
148s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 07:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
-
Size
748KB
-
MD5
fc3c1f2a8c9f207ef70331cf74f44c1f
-
SHA1
f229051de637644ac71fb954836c63d57262e53d
-
SHA256
8ddf1a52cec3cb0b6973150d85d1672d5c443e10fa395edb9258fd0fa6bd9838
-
SHA512
b29c96d126fddd770e07340beb18fe1f4ee1c907a6d39cb3d0e945564ca5f3011f6a2defc1912175cdf20eb0a57f286a9240f3af0107f1617d37c679190f4f4c
-
SSDEEP
12288:+WQr2RQNI/MbOG3JNP/6hHXfRDHR5YiOAaGa0+eckUz+iFyL:+mWIUbOG37Q3fRgNGa0+IW5Fi
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exefc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exedescription pid Process procid_target PID 2272 set thread context of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2196 set thread context of 2756 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 29 PID 2756 set thread context of 2696 2756 explorer.exe 30 -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exedescription pid Process Token: SeIncreaseQuotaPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeSecurityPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeSystemtimePrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeBackupPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeRestorePrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeShutdownPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeUndockPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeManageVolumePrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeImpersonatePrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: 33 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: 34 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: 35 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2696 explorer.exe Token: SeSecurityPrivilege 2696 explorer.exe Token: SeTakeOwnershipPrivilege 2696 explorer.exe Token: SeLoadDriverPrivilege 2696 explorer.exe Token: SeSystemProfilePrivilege 2696 explorer.exe Token: SeSystemtimePrivilege 2696 explorer.exe Token: SeProfSingleProcessPrivilege 2696 explorer.exe Token: SeIncBasePriorityPrivilege 2696 explorer.exe Token: SeCreatePagefilePrivilege 2696 explorer.exe Token: SeBackupPrivilege 2696 explorer.exe Token: SeRestorePrivilege 2696 explorer.exe Token: SeShutdownPrivilege 2696 explorer.exe Token: SeDebugPrivilege 2696 explorer.exe Token: SeSystemEnvironmentPrivilege 2696 explorer.exe Token: SeChangeNotifyPrivilege 2696 explorer.exe Token: SeRemoteShutdownPrivilege 2696 explorer.exe Token: SeUndockPrivilege 2696 explorer.exe Token: SeManageVolumePrivilege 2696 explorer.exe Token: SeImpersonatePrivilege 2696 explorer.exe Token: SeCreateGlobalPrivilege 2696 explorer.exe Token: 33 2696 explorer.exe Token: 34 2696 explorer.exe Token: 35 2696 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exepid Process 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 2756 explorer.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exefc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exedescription pid Process procid_target PID 2272 wrote to memory of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2272 wrote to memory of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2272 wrote to memory of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2272 wrote to memory of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2272 wrote to memory of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2272 wrote to memory of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2272 wrote to memory of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2272 wrote to memory of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2272 wrote to memory of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2272 wrote to memory of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2272 wrote to memory of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2272 wrote to memory of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2272 wrote to memory of 2196 2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 28 PID 2196 wrote to memory of 2756 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2756 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2756 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2756 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2756 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2756 2196 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 29 PID 2756 wrote to memory of 2696 2756 explorer.exe 30 PID 2756 wrote to memory of 2696 2756 explorer.exe 30 PID 2756 wrote to memory of 2696 2756 explorer.exe 30 PID 2756 wrote to memory of 2696 2756 explorer.exe 30 PID 2756 wrote to memory of 2696 2756 explorer.exe 30 PID 2756 wrote to memory of 2696 2756 explorer.exe 30 PID 2756 wrote to memory of 2696 2756 explorer.exe 30 PID 2756 wrote to memory of 2696 2756 explorer.exe 30 PID 2756 wrote to memory of 2696 2756 explorer.exe 30 PID 2756 wrote to memory of 2696 2756 explorer.exe 30 PID 2756 wrote to memory of 2696 2756 explorer.exe 30 PID 2756 wrote to memory of 2696 2756 explorer.exe 30 PID 2756 wrote to memory of 2696 2756 explorer.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
-