Analysis
-
max time kernel
156s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 07:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
-
Size
748KB
-
MD5
fc3c1f2a8c9f207ef70331cf74f44c1f
-
SHA1
f229051de637644ac71fb954836c63d57262e53d
-
SHA256
8ddf1a52cec3cb0b6973150d85d1672d5c443e10fa395edb9258fd0fa6bd9838
-
SHA512
b29c96d126fddd770e07340beb18fe1f4ee1c907a6d39cb3d0e945564ca5f3011f6a2defc1912175cdf20eb0a57f286a9240f3af0107f1617d37c679190f4f4c
-
SSDEEP
12288:+WQr2RQNI/MbOG3JNP/6hHXfRDHR5YiOAaGa0+eckUz+iFyL:+mWIUbOG37Q3fRgNGa0+IW5Fi
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exewinupdate.exeexplorer.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
winupdate.exewinupdate.exepid Process 488 winupdate.exe 2852 winupdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exewinupdate.exewinupdate.exeexplorer.exedescription pid Process procid_target PID 3220 set thread context of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 488 set thread context of 2852 488 winupdate.exe 95 PID 2852 set thread context of 60 2852 winupdate.exe 96 PID 60 set thread context of 4220 60 explorer.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exewinupdate.exeexplorer.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exewinupdate.exeexplorer.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exewinupdate.exeexplorer.exedescription pid Process Token: SeIncreaseQuotaPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeSecurityPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeLoadDriverPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeSystemProfilePrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeSystemtimePrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeBackupPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeRestorePrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeShutdownPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeDebugPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeUndockPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeManageVolumePrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeImpersonatePrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: 33 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: 34 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: 35 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: 36 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2852 winupdate.exe Token: SeSecurityPrivilege 2852 winupdate.exe Token: SeTakeOwnershipPrivilege 2852 winupdate.exe Token: SeLoadDriverPrivilege 2852 winupdate.exe Token: SeSystemProfilePrivilege 2852 winupdate.exe Token: SeSystemtimePrivilege 2852 winupdate.exe Token: SeProfSingleProcessPrivilege 2852 winupdate.exe Token: SeIncBasePriorityPrivilege 2852 winupdate.exe Token: SeCreatePagefilePrivilege 2852 winupdate.exe Token: SeBackupPrivilege 2852 winupdate.exe Token: SeRestorePrivilege 2852 winupdate.exe Token: SeShutdownPrivilege 2852 winupdate.exe Token: SeDebugPrivilege 2852 winupdate.exe Token: SeSystemEnvironmentPrivilege 2852 winupdate.exe Token: SeChangeNotifyPrivilege 2852 winupdate.exe Token: SeRemoteShutdownPrivilege 2852 winupdate.exe Token: SeUndockPrivilege 2852 winupdate.exe Token: SeManageVolumePrivilege 2852 winupdate.exe Token: SeImpersonatePrivilege 2852 winupdate.exe Token: SeCreateGlobalPrivilege 2852 winupdate.exe Token: 33 2852 winupdate.exe Token: 34 2852 winupdate.exe Token: 35 2852 winupdate.exe Token: 36 2852 winupdate.exe Token: SeIncreaseQuotaPrivilege 4220 explorer.exe Token: SeSecurityPrivilege 4220 explorer.exe Token: SeTakeOwnershipPrivilege 4220 explorer.exe Token: SeLoadDriverPrivilege 4220 explorer.exe Token: SeSystemProfilePrivilege 4220 explorer.exe Token: SeSystemtimePrivilege 4220 explorer.exe Token: SeProfSingleProcessPrivilege 4220 explorer.exe Token: SeIncBasePriorityPrivilege 4220 explorer.exe Token: SeCreatePagefilePrivilege 4220 explorer.exe Token: SeBackupPrivilege 4220 explorer.exe Token: SeRestorePrivilege 4220 explorer.exe Token: SeShutdownPrivilege 4220 explorer.exe Token: SeDebugPrivilege 4220 explorer.exe Token: SeSystemEnvironmentPrivilege 4220 explorer.exe Token: SeChangeNotifyPrivilege 4220 explorer.exe Token: SeRemoteShutdownPrivilege 4220 explorer.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exewinupdate.exeexplorer.exepid Process 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 488 winupdate.exe 60 explorer.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exefc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exewinupdate.exewinupdate.exeexplorer.exedescription pid Process procid_target PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 3220 wrote to memory of 5036 3220 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 92 PID 5036 wrote to memory of 1192 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 93 PID 5036 wrote to memory of 1192 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 93 PID 5036 wrote to memory of 1192 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 93 PID 5036 wrote to memory of 488 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 94 PID 5036 wrote to memory of 488 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 94 PID 5036 wrote to memory of 488 5036 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe 94 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 488 wrote to memory of 2852 488 winupdate.exe 95 PID 2852 wrote to memory of 60 2852 winupdate.exe 96 PID 2852 wrote to memory of 60 2852 winupdate.exe 96 PID 2852 wrote to memory of 60 2852 winupdate.exe 96 PID 2852 wrote to memory of 60 2852 winupdate.exe 96 PID 2852 wrote to memory of 60 2852 winupdate.exe 96 PID 60 wrote to memory of 4220 60 explorer.exe 97 PID 60 wrote to memory of 4220 60 explorer.exe 97 PID 60 wrote to memory of 4220 60 explorer.exe 97 PID 60 wrote to memory of 4220 60 explorer.exe 97 PID 60 wrote to memory of 4220 60 explorer.exe 97 PID 60 wrote to memory of 4220 60 explorer.exe 97 PID 60 wrote to memory of 4220 60 explorer.exe 97 PID 60 wrote to memory of 4220 60 explorer.exe 97 PID 60 wrote to memory of 4220 60 explorer.exe 97 PID 60 wrote to memory of 4220 60 explorer.exe 97 PID 60 wrote to memory of 4220 60 explorer.exe 97 PID 60 wrote to memory of 4220 60 explorer.exe 97 PID 60 wrote to memory of 4220 60 explorer.exe 97 PID 60 wrote to memory of 4220 60 explorer.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵PID:1192
-
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Windupdt\winupdate.exeC:\Windupdt\winupdate.exe4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:81⤵PID:2908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
748KB
MD5fc3c1f2a8c9f207ef70331cf74f44c1f
SHA1f229051de637644ac71fb954836c63d57262e53d
SHA2568ddf1a52cec3cb0b6973150d85d1672d5c443e10fa395edb9258fd0fa6bd9838
SHA512b29c96d126fddd770e07340beb18fe1f4ee1c907a6d39cb3d0e945564ca5f3011f6a2defc1912175cdf20eb0a57f286a9240f3af0107f1617d37c679190f4f4c