Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 04:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe
-
Size
816KB
-
MD5
fe7cff60621bc39bcb6b06aa89eab455
-
SHA1
347dfeb8fe8131eb47511731f4aebe061232ddd6
-
SHA256
bdca0dc5a747283dda93176036564a0637e287a077951cc394e1acc65404821c
-
SHA512
dee269d07e6e5055ddd02f63b99ce6879092242ee5c009e62967df0ec44ff4d9b6c86a13b3e3e0489c89fb56e347fd6a4b7d91c09de2d943c14f4cdda8ed5c1b
-
SSDEEP
12288:/KM2wD/U1gmeDvMo/cxdnB3DeomG/SHfLqdY6k0DNlHWZQW9:/KM9TUjeDvMfrVDZmG/STqm0DnWa0
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" winupdate.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile winupdate.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" winupdate.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" winupdate.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winupdate.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winupdate.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 4820 winupdate.exe 4648 winupdate.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2024 set thread context of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 4820 set thread context of 4648 4820 winupdate.exe 105 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4648 winupdate.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeSecurityPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeLoadDriverPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeSystemProfilePrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeSystemtimePrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeBackupPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeRestorePrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeShutdownPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeDebugPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeUndockPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeManageVolumePrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeImpersonatePrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: 33 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: 34 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: 35 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: 36 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 4648 winupdate.exe Token: SeSecurityPrivilege 4648 winupdate.exe Token: SeTakeOwnershipPrivilege 4648 winupdate.exe Token: SeLoadDriverPrivilege 4648 winupdate.exe Token: SeSystemProfilePrivilege 4648 winupdate.exe Token: SeSystemtimePrivilege 4648 winupdate.exe Token: SeProfSingleProcessPrivilege 4648 winupdate.exe Token: SeIncBasePriorityPrivilege 4648 winupdate.exe Token: SeCreatePagefilePrivilege 4648 winupdate.exe Token: SeBackupPrivilege 4648 winupdate.exe Token: SeRestorePrivilege 4648 winupdate.exe Token: SeShutdownPrivilege 4648 winupdate.exe Token: SeDebugPrivilege 4648 winupdate.exe Token: SeSystemEnvironmentPrivilege 4648 winupdate.exe Token: SeChangeNotifyPrivilege 4648 winupdate.exe Token: SeRemoteShutdownPrivilege 4648 winupdate.exe Token: SeUndockPrivilege 4648 winupdate.exe Token: SeManageVolumePrivilege 4648 winupdate.exe Token: SeImpersonatePrivilege 4648 winupdate.exe Token: SeCreateGlobalPrivilege 4648 winupdate.exe Token: 33 4648 winupdate.exe Token: 34 4648 winupdate.exe Token: 35 4648 winupdate.exe Token: 36 4648 winupdate.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 2024 wrote to memory of 388 2024 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 100 PID 388 wrote to memory of 4820 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 101 PID 388 wrote to memory of 4820 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 101 PID 388 wrote to memory of 4820 388 fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe 101 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 PID 4820 wrote to memory of 4648 4820 winupdate.exe 105 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" winupdate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4648
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816KB
MD5fe7cff60621bc39bcb6b06aa89eab455
SHA1347dfeb8fe8131eb47511731f4aebe061232ddd6
SHA256bdca0dc5a747283dda93176036564a0637e287a077951cc394e1acc65404821c
SHA512dee269d07e6e5055ddd02f63b99ce6879092242ee5c009e62967df0ec44ff4d9b6c86a13b3e3e0489c89fb56e347fd6a4b7d91c09de2d943c14f4cdda8ed5c1b