Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 19:49
Static task
static1
Behavioral task
behavioral1
Sample
037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe
-
Size
4.3MB
-
MD5
037e9f1ec832baabe53323cbd57603c6
-
SHA1
89dc1f40f9a97d73b2d5ad059a61b0a3e783cc35
-
SHA256
bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44
-
SHA512
16145105bc6ced023d143f21ed687d6c1dc92925af592e3bdb9510c77afe1abd2b7e92e24f2ab515d1189b5ff31529a60b950f0e5ce37dc309a14630a8de6c68
-
SSDEEP
98304:ucMkgLrnO38RzYf0ML2x5tTDaLclizm7KQF1iEaGzMU+:u/kgLz9RzYI7Da4Ii7KQrLMU+
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a000000023b6a-52.dat acprotect behavioral2/files/0x000a000000023b6b-53.dat acprotect -
resource yara_rule behavioral2/files/0x000a000000023b69-22.dat aspack_v212_v242 behavioral2/files/0x000a000000023b68-54.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe -
Executes dropped EXE 7 IoCs
pid Process 4496 rutserv.exe 2552 rutserv.exe 5044 rutserv.exe 1992 rutserv.exe 448 rfusclient.exe 4248 rfusclient.exe 3488 rfusclient.exe -
resource yara_rule behavioral2/files/0x000a000000023b6a-52.dat upx behavioral2/files/0x000a000000023b6b-53.dat upx -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rutserv.pdb rutserv.exe File opened for modification C:\Windows\SysWOW64\exe\rutserv.pdb rutserv.exe File opened for modification C:\Windows\SysWOW64\symbols\exe\rutserv.pdb rutserv.exe -
Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files\word\install.vbs 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File opened for modification C:\Program Files\word\regedit.reg 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File opened for modification C:\Program Files\word\rfusclient.exe 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File created C:\Program Files\word\1.doc 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File opened for modification C:\Program Files\word\1.doc WINWORD.EXE File opened for modification C:\Program Files\word\rutserv.pdb rutserv.exe File opened for modification C:\Program Files\word 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File created C:\Program Files\word\__tmp_rar_sfx_access_check_240594250 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File opened for modification C:\Program Files\word\install.bat 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File opened for modification C:\Program Files\word\install.vbs 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File created C:\Program Files\word\rfusclient.exe 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File created C:\Program Files\word\rutserv.exe 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File created C:\Program Files\word\install.bat 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File created C:\Program Files\word\regedit.reg 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File opened for modification C:\Program Files\word\rutserv.exe 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File created C:\Program Files\word\vp8decoder.dll 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File opened for modification C:\Program Files\word\vp8encoder.dll 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File opened for modification C:\Program Files\word\vp8decoder.dll 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File created C:\Program Files\word\vp8encoder.dll 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File opened for modification C:\Program Files\word\1.doc 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe File created C:\Program Files\word\~$1.doc WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Delays execution with timeout.exe 1 IoCs
pid Process 4536 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Kills process with taskkill 2 IoCs
pid Process 4944 taskkill.exe 5108 taskkill.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings cmd.exe -
Runs .reg file with regedit 1 IoCs
pid Process 3336 regedit.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 736 WINWORD.EXE 736 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4496 rutserv.exe 4496 rutserv.exe 4496 rutserv.exe 4496 rutserv.exe 4496 rutserv.exe 4496 rutserv.exe 2552 rutserv.exe 2552 rutserv.exe 5044 rutserv.exe 5044 rutserv.exe 1992 rutserv.exe 1992 rutserv.exe 1992 rutserv.exe 1992 rutserv.exe 1992 rutserv.exe 1992 rutserv.exe 448 rfusclient.exe 448 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 3488 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4944 taskkill.exe Token: SeDebugPrivilege 5108 taskkill.exe Token: SeDebugPrivilege 4496 rutserv.exe Token: SeDebugPrivilege 5044 rutserv.exe Token: SeTakeOwnershipPrivilege 1992 rutserv.exe Token: SeTcbPrivilege 1992 rutserv.exe Token: SeTcbPrivilege 1992 rutserv.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 4496 rutserv.exe 2552 rutserv.exe 5044 rutserv.exe 1992 rutserv.exe 736 WINWORD.EXE 736 WINWORD.EXE 736 WINWORD.EXE 736 WINWORD.EXE 736 WINWORD.EXE 736 WINWORD.EXE 736 WINWORD.EXE -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4608 wrote to memory of 2172 4608 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe 83 PID 4608 wrote to memory of 2172 4608 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe 83 PID 4608 wrote to memory of 2172 4608 037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe 83 PID 2172 wrote to memory of 4384 2172 WScript.exe 84 PID 2172 wrote to memory of 4384 2172 WScript.exe 84 PID 2172 wrote to memory of 4384 2172 WScript.exe 84 PID 4384 wrote to memory of 4944 4384 cmd.exe 87 PID 4384 wrote to memory of 4944 4384 cmd.exe 87 PID 4384 wrote to memory of 4944 4384 cmd.exe 87 PID 4384 wrote to memory of 5108 4384 cmd.exe 90 PID 4384 wrote to memory of 5108 4384 cmd.exe 90 PID 4384 wrote to memory of 5108 4384 cmd.exe 90 PID 4384 wrote to memory of 2760 4384 cmd.exe 92 PID 4384 wrote to memory of 2760 4384 cmd.exe 92 PID 4384 wrote to memory of 2760 4384 cmd.exe 92 PID 4384 wrote to memory of 3336 4384 cmd.exe 93 PID 4384 wrote to memory of 3336 4384 cmd.exe 93 PID 4384 wrote to memory of 3336 4384 cmd.exe 93 PID 4384 wrote to memory of 4536 4384 cmd.exe 94 PID 4384 wrote to memory of 4536 4384 cmd.exe 94 PID 4384 wrote to memory of 4536 4384 cmd.exe 94 PID 4384 wrote to memory of 4496 4384 cmd.exe 95 PID 4384 wrote to memory of 4496 4384 cmd.exe 95 PID 4384 wrote to memory of 4496 4384 cmd.exe 95 PID 4384 wrote to memory of 2552 4384 cmd.exe 96 PID 4384 wrote to memory of 2552 4384 cmd.exe 96 PID 4384 wrote to memory of 2552 4384 cmd.exe 96 PID 4384 wrote to memory of 5044 4384 cmd.exe 97 PID 4384 wrote to memory of 5044 4384 cmd.exe 97 PID 4384 wrote to memory of 5044 4384 cmd.exe 97 PID 1992 wrote to memory of 448 1992 rutserv.exe 99 PID 1992 wrote to memory of 448 1992 rutserv.exe 99 PID 1992 wrote to memory of 448 1992 rutserv.exe 99 PID 1992 wrote to memory of 4248 1992 rutserv.exe 100 PID 1992 wrote to memory of 4248 1992 rutserv.exe 100 PID 1992 wrote to memory of 4248 1992 rutserv.exe 100 PID 4384 wrote to memory of 736 4384 cmd.exe 101 PID 4384 wrote to memory of 736 4384 cmd.exe 101 PID 448 wrote to memory of 3488 448 rfusclient.exe 103 PID 448 wrote to memory of 3488 448 rfusclient.exe 103 PID 448 wrote to memory of 3488 448 rfusclient.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\037e9f1ec832baabe53323cbd57603c6_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\word\install.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\word\install.bat" "3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rutserv.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfusclient.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f4⤵PID:2760
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "regedit.reg"4⤵
- Runs .reg file with regedit
PID:3336
-
-
C:\Windows\SysWOW64\timeout.exetimeout 24⤵
- Delays execution with timeout.exe
PID:4536
-
-
C:\Program Files\word\rutserv.exerutserv.exe /silentinstall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4496
-
-
C:\Program Files\word\rutserv.exerutserv.exe /firewall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2552
-
-
C:\Program Files\word\rutserv.exerutserv.exe /start4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5044
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Program Files\word\1.doc" /o ""4⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:736
-
-
-
-
C:\Program Files\word\rutserv.exe"C:\Program Files\word\rutserv.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files\word\rfusclient.exe"C:\Program Files\word\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Program Files\word\rfusclient.exe"C:\Program Files\word\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:3488
-
-
-
C:\Program Files\word\rfusclient.exe"C:\Program Files\word\rfusclient.exe" /tray2⤵
- Executes dropped EXE
PID:4248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD52d17816c1b66dd964511796c037045e5
SHA14f7199f48ed081de8a904a77ed73c65f35d15bf9
SHA2569585e54a4d46e70491c8098d9abeaeb470a12a2a45e1bfd00100d28d79df61c4
SHA5120b0c21f94ae6d4f7687a7e1fc92e182abd39da807f4465c22830d0a9425731d603c790d85481d3fbc4d6cfd34a2bb899adf02b30f30bfb0ad9bc031b51fe37be
-
Filesize
304B
MD573e89f8df08e778feca688998addfec4
SHA1a715a2dba5412da8bfd17ccff4cf931822463085
SHA2560506dec7ee56d3e967dba45fa02e410a9c79530878244c2b23e6599ec7ff6bfd
SHA512a93d30718fefc5b2dcf17f16b599f03f91fb7e8e99d9a2a7986d6138755866772446cd1c287b85c849b5505735f1d924aff534e5857a8a79e157c237f98892d2
-
Filesize
117B
MD565fc32766a238ff3e95984e325357dbb
SHA13ac16a2648410be8aa75f3e2817fbf69bb0e8922
SHA256a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420
SHA512621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608
-
Filesize
11KB
MD57b9375d672ff35e2331439dc4bfb95a2
SHA176bef183b79906643cd95177d2f4976666ec1d76
SHA2567a1071e0068f10191ff416c9133f133d63a56de1fc3c62baa4e57e3acecd7fa6
SHA5124aee9306a57570e99de699f8f6cb6eb2541fdbcc35b036cd90dbe5e15468faa61372c68b15b09f827a5bea5cdcb6eef6107bec4120b7e23674e6d979499e8e22
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
155KB
MD588318158527985702f61d169434a4940
SHA13cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA2564c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA5125d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff
-
Filesize
593KB
MD56298c0af3d1d563834a218a9cc9f54bd
SHA10185cd591e454ed072e5a5077b25c612f6849dc9
SHA25681af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5eb955dcadac17418b5c0a04ddc057b69
SHA1d8794dff3cd8d5c784cfcb564f14d983b5748e15
SHA2567abfd26f54be31b865bf2ee392de20d50556171ede5ed09746e1b4076aa35a84
SHA512caa77f41b37214be895b80934132fae8c60b76c6860c972e985d4484b24175ff56674643dbc03f6565621a4081603221d2fd8652d6255760e2cb781845410a11
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD50e0c8bb46e5bb699daf8695a9f5896c5
SHA18e569c3b9f4632032b360322b3235099d3ef750c
SHA256483e3eb7584166a91043e18ae3b7d38524ccb6f74e653b37308cd2eaeea12e20
SHA5127b9a26ab2e83c95a34017deec33b798721471649fac794dabc48621e42d14bb6892fbba2896c3c0df037922b034ce5205bce69807a3cf7017ea3fb23918d87ac