Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 11:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe
-
Size
320KB
-
MD5
fcb86a86a1cd1451c51964574bf5a43e
-
SHA1
68690d11595eec4e60c4c7025c4137d21a12887a
-
SHA256
ea62993d7be8a983f105115c05ee3fe9a8967791554823e31fdc2d4d8b16d154
-
SHA512
ee2eabb5f730dddcea94ff6aa5e906e729f222dd1226dc31626f0a015a85fcc5e66e56f4fa09c8fa89622a9af6daaf1dffa562cd672581c82fa96f7e26742a73
-
SSDEEP
6144:PPAEj0eMUnTa6haaegatOrW4+CQtKZDFNbBoOWULM2F:PdVMUn+da5rWlCOKJPbBpZ42F
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\GU\\GoogleUpdate.exe" fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exeGoogleUpdate.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate GoogleUpdate.exe -
Executes dropped EXE 2 IoCs
Processes:
GoogleUpdate.exeGoogleUpdate.exepid Process 2552 GoogleUpdate.exe 2976 GoogleUpdate.exe -
Loads dropped DLL 8 IoCs
Processes:
fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exeGoogleUpdate.exeGoogleUpdate.exepid Process 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 2552 GoogleUpdate.exe 2552 GoogleUpdate.exe 2552 GoogleUpdate.exe 2552 GoogleUpdate.exe 2976 GoogleUpdate.exe 2976 GoogleUpdate.exe 2976 GoogleUpdate.exe -
Processes:
resource yara_rule behavioral1/memory/2208-4-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2208-9-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2208-6-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2208-5-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2208-10-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2208-11-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2208-12-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2208-14-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2208-24-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-40-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-45-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-46-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-47-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-48-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-50-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-49-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-51-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-52-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-53-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-54-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-55-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-56-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-57-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-58-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-59-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-60-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-61-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-62-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-63-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-64-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-65-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2976-66-0x0000000000400000-0x00000000004C5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpate = "C:\\Users\\Admin\\AppData\\Roaming\\GU\\GoogleUpdate.exe" fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exeGoogleUpdate.exedescription pid Process procid_target PID 836 set thread context of 2208 836 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 28 PID 2552 set thread context of 2976 2552 GoogleUpdate.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exeGoogleUpdate.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoogleUpdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoogleUpdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier GoogleUpdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier GoogleUpdate.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exeGoogleUpdate.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier GoogleUpdate.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
Processes:
fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exeGoogleUpdate.exeGoogleUpdate.exepid Process 836 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 2552 GoogleUpdate.exe 2976 GoogleUpdate.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exeGoogleUpdate.exedescription pid Process Token: SeIncreaseQuotaPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeSecurityPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeSystemtimePrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeBackupPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeRestorePrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeShutdownPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeDebugPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeUndockPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeManageVolumePrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeImpersonatePrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: 33 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: 34 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: 35 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2976 GoogleUpdate.exe Token: SeSecurityPrivilege 2976 GoogleUpdate.exe Token: SeTakeOwnershipPrivilege 2976 GoogleUpdate.exe Token: SeLoadDriverPrivilege 2976 GoogleUpdate.exe Token: SeSystemProfilePrivilege 2976 GoogleUpdate.exe Token: SeSystemtimePrivilege 2976 GoogleUpdate.exe Token: SeProfSingleProcessPrivilege 2976 GoogleUpdate.exe Token: SeIncBasePriorityPrivilege 2976 GoogleUpdate.exe Token: SeCreatePagefilePrivilege 2976 GoogleUpdate.exe Token: SeBackupPrivilege 2976 GoogleUpdate.exe Token: SeRestorePrivilege 2976 GoogleUpdate.exe Token: SeShutdownPrivilege 2976 GoogleUpdate.exe Token: SeDebugPrivilege 2976 GoogleUpdate.exe Token: SeSystemEnvironmentPrivilege 2976 GoogleUpdate.exe Token: SeChangeNotifyPrivilege 2976 GoogleUpdate.exe Token: SeRemoteShutdownPrivilege 2976 GoogleUpdate.exe Token: SeUndockPrivilege 2976 GoogleUpdate.exe Token: SeManageVolumePrivilege 2976 GoogleUpdate.exe Token: SeImpersonatePrivilege 2976 GoogleUpdate.exe Token: SeCreateGlobalPrivilege 2976 GoogleUpdate.exe Token: 33 2976 GoogleUpdate.exe Token: 34 2976 GoogleUpdate.exe Token: 35 2976 GoogleUpdate.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exefcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exeGoogleUpdate.exedescription pid Process procid_target PID 836 wrote to memory of 2208 836 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 28 PID 836 wrote to memory of 2208 836 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 28 PID 836 wrote to memory of 2208 836 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 28 PID 836 wrote to memory of 2208 836 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 28 PID 836 wrote to memory of 2208 836 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 28 PID 836 wrote to memory of 2208 836 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 28 PID 836 wrote to memory of 2208 836 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 28 PID 2208 wrote to memory of 2552 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 29 PID 2208 wrote to memory of 2552 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 29 PID 2208 wrote to memory of 2552 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 29 PID 2208 wrote to memory of 2552 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 29 PID 2208 wrote to memory of 2552 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 29 PID 2208 wrote to memory of 2552 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 29 PID 2208 wrote to memory of 2552 2208 fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe 29 PID 2552 wrote to memory of 2976 2552 GoogleUpdate.exe 30 PID 2552 wrote to memory of 2976 2552 GoogleUpdate.exe 30 PID 2552 wrote to memory of 2976 2552 GoogleUpdate.exe 30 PID 2552 wrote to memory of 2976 2552 GoogleUpdate.exe 30 PID 2552 wrote to memory of 2976 2552 GoogleUpdate.exe 30 PID 2552 wrote to memory of 2976 2552 GoogleUpdate.exe 30 PID 2552 wrote to memory of 2976 2552 GoogleUpdate.exe 30 PID 2552 wrote to memory of 2976 2552 GoogleUpdate.exe 30 PID 2552 wrote to memory of 2976 2552 GoogleUpdate.exe 30 PID 2552 wrote to memory of 2976 2552 GoogleUpdate.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fcb86a86a1cd1451c51964574bf5a43e_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Roaming\GU\GoogleUpdate.exe"C:\Users\Admin\AppData\Roaming\GU\GoogleUpdate.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Roaming\GU\GoogleUpdate.exeC:\Users\Admin\AppData\Roaming\GU\GoogleUpdate.exe4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320KB
MD5fcb86a86a1cd1451c51964574bf5a43e
SHA168690d11595eec4e60c4c7025c4137d21a12887a
SHA256ea62993d7be8a983f105115c05ee3fe9a8967791554823e31fdc2d4d8b16d154
SHA512ee2eabb5f730dddcea94ff6aa5e906e729f222dd1226dc31626f0a015a85fcc5e66e56f4fa09c8fa89622a9af6daaf1dffa562cd672581c82fa96f7e26742a73