Analysis
-
max time kernel
83s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 20:30
Behavioral task
behavioral1
Sample
019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe
Resource
win7-20240215-en
Errors
General
-
Target
019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
019a4e9d2dfd1eab14adb07bb6ea33d5
-
SHA1
05f36c386c849ad775be9b5836a8d8cd4734de7e
-
SHA256
8279c8a068aa0bd266a182c72107078faeb71cbd1d7344d9fec39d12403cbf12
-
SHA512
dbeaafab8db8528dbd4bfd3c2267d321bfb3811b290d3408d025c4c6f37f1d29bde7d74111fada9b20902f47c52fee0ef8885b37361abdbf2ba32560eefb08e8
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZJ:0UzeyQMS4DqodCnoe+iitjWwwl
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe -
Executes dropped EXE 30 IoCs
pid Process 3140 explorer.exe 1752 explorer.exe 400 spoolsv.exe 1396 spoolsv.exe 3752 spoolsv.exe 4400 spoolsv.exe 1856 spoolsv.exe 4704 spoolsv.exe 4972 spoolsv.exe 4956 spoolsv.exe 4132 spoolsv.exe 5020 spoolsv.exe 1008 spoolsv.exe 1316 spoolsv.exe 4920 spoolsv.exe 3832 spoolsv.exe 1292 spoolsv.exe 4120 spoolsv.exe 1820 spoolsv.exe 3052 spoolsv.exe 2016 spoolsv.exe 4720 spoolsv.exe 4184 spoolsv.exe 3744 spoolsv.exe 4984 spoolsv.exe 412 spoolsv.exe 2072 spoolsv.exe 4288 spoolsv.exe 2616 spoolsv.exe 1028 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4880 set thread context of 4708 4880 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 90 PID 3140 set thread context of 1752 3140 explorer.exe 100 -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 4708 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 4708 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4708 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 4708 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4880 wrote to memory of 1564 4880 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 84 PID 4880 wrote to memory of 1564 4880 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 84 PID 4880 wrote to memory of 4708 4880 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 90 PID 4880 wrote to memory of 4708 4880 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 90 PID 4880 wrote to memory of 4708 4880 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 90 PID 4880 wrote to memory of 4708 4880 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 90 PID 4880 wrote to memory of 4708 4880 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 90 PID 4708 wrote to memory of 3140 4708 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 91 PID 4708 wrote to memory of 3140 4708 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 91 PID 4708 wrote to memory of 3140 4708 019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe 91 PID 3140 wrote to memory of 1752 3140 explorer.exe 100 PID 3140 wrote to memory of 1752 3140 explorer.exe 100 PID 3140 wrote to memory of 1752 3140 explorer.exe 100 PID 3140 wrote to memory of 1752 3140 explorer.exe 100 PID 3140 wrote to memory of 1752 3140 explorer.exe 100 PID 1752 wrote to memory of 400 1752 explorer.exe 101 PID 1752 wrote to memory of 400 1752 explorer.exe 101 PID 1752 wrote to memory of 400 1752 explorer.exe 101 PID 1752 wrote to memory of 1396 1752 explorer.exe 102 PID 1752 wrote to memory of 1396 1752 explorer.exe 102 PID 1752 wrote to memory of 1396 1752 explorer.exe 102 PID 1752 wrote to memory of 3752 1752 explorer.exe 103 PID 1752 wrote to memory of 3752 1752 explorer.exe 103 PID 1752 wrote to memory of 3752 1752 explorer.exe 103 PID 1752 wrote to memory of 4400 1752 explorer.exe 104 PID 1752 wrote to memory of 4400 1752 explorer.exe 104 PID 1752 wrote to memory of 4400 1752 explorer.exe 104 PID 1752 wrote to memory of 1856 1752 explorer.exe 105 PID 1752 wrote to memory of 1856 1752 explorer.exe 105 PID 1752 wrote to memory of 1856 1752 explorer.exe 105 PID 1752 wrote to memory of 4704 1752 explorer.exe 107 PID 1752 wrote to memory of 4704 1752 explorer.exe 107 PID 1752 wrote to memory of 4704 1752 explorer.exe 107 PID 1752 wrote to memory of 4972 1752 explorer.exe 108 PID 1752 wrote to memory of 4972 1752 explorer.exe 108 PID 1752 wrote to memory of 4972 1752 explorer.exe 108 PID 1752 wrote to memory of 4956 1752 explorer.exe 109 PID 1752 wrote to memory of 4956 1752 explorer.exe 109 PID 1752 wrote to memory of 4956 1752 explorer.exe 109 PID 1752 wrote to memory of 4132 1752 explorer.exe 110 PID 1752 wrote to memory of 4132 1752 explorer.exe 110 PID 1752 wrote to memory of 4132 1752 explorer.exe 110 PID 1752 wrote to memory of 5020 1752 explorer.exe 111 PID 1752 wrote to memory of 5020 1752 explorer.exe 111 PID 1752 wrote to memory of 5020 1752 explorer.exe 111 PID 1752 wrote to memory of 1008 1752 explorer.exe 112 PID 1752 wrote to memory of 1008 1752 explorer.exe 112 PID 1752 wrote to memory of 1008 1752 explorer.exe 112 PID 1752 wrote to memory of 1316 1752 explorer.exe 113 PID 1752 wrote to memory of 1316 1752 explorer.exe 113 PID 1752 wrote to memory of 1316 1752 explorer.exe 113 PID 1752 wrote to memory of 4920 1752 explorer.exe 114 PID 1752 wrote to memory of 4920 1752 explorer.exe 114 PID 1752 wrote to memory of 4920 1752 explorer.exe 114 PID 1752 wrote to memory of 3832 1752 explorer.exe 115 PID 1752 wrote to memory of 3832 1752 explorer.exe 115 PID 1752 wrote to memory of 3832 1752 explorer.exe 115 PID 1752 wrote to memory of 1292 1752 explorer.exe 116 PID 1752 wrote to memory of 1292 1752 explorer.exe 116 PID 1752 wrote to memory of 1292 1752 explorer.exe 116 PID 1752 wrote to memory of 4120 1752 explorer.exe 117 PID 1752 wrote to memory of 4120 1752 explorer.exe 117 PID 1752 wrote to memory of 4120 1752 explorer.exe 117 PID 1752 wrote to memory of 1820 1752 explorer.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\019a4e9d2dfd1eab14adb07bb6ea33d5_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:400
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1396
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3752
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4400
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1856
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4704
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4972
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4956
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4132
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5020
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1008
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1316
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4920
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3832
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1292
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4120
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1820
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3052
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2016
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4720
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4184
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3744
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4984
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:412
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2072
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4288
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2616
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1028
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4860
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD54da99134dc810a4c3c4821ba6be9eae0
SHA1855aa345480821f6bfe6200a785b08f3d5449a43
SHA2564c3365c48c9031e8d2b4920f5f973f98354f16239153a0249b012edc8884ac04
SHA5121288e8075810ff824c87a81f1f382f890827c6ba26ccb32dc6be038edfc6b5bcbd830520422a867c741d2f100f1644d7e117034eb3e22ef844d9b0df21b5d967
-
Filesize
2.2MB
MD53c936950a01d55c2e1bc70f37bc9dff5
SHA18148e572fc863395eaff9342239cfcdd79fece83
SHA256be8bf4edfd9fe4c3ceab97ba6a3888a235f38de23ac35188eeaeb2719b431e64
SHA5122ef392075c4c537e8fd94071089026cd505dcbf3452f200f1bda731a7e495d9199d00ceca1ef06f58707cfc362c7ba4a9d9132be419d72ee5eb78a5bb32d2027