Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 08:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe
-
Size
480KB
-
MD5
04c2b38b56160a4d891a9ee1f9e82601
-
SHA1
db6301dda876503ecb35f25faeec03d3fef71f99
-
SHA256
06439f9d182b0310432dec563f406ad9a58f5be28290812cd7ddb932690299e9
-
SHA512
7df00c63afc375d9b52aaa3a3421e34362980fe5bc674d7a2ca77ad2de48c6c73d0c73dc3f75bd38143ab30b8434445064c76ef0ddb64cd48d67a49635a0fb3f
-
SSDEEP
6144:Oh5IVKmFs4Hb4I2HIEi+nPHawdn0/JRSerTWIdeFjkZM6jI7F1eZ9A3Xj:q5IVKCsC4IsKRFqIQFjkZM6jI7TeZi
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Runescape DDoS V 2.7.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Runescape DDoS V 2.7.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\NetUpdate.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Runescape DDoS V 2.7.exe" 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DD35EEE5-EF8F-E6DC-6675-ADFFAAC91FDB} 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DD35EEE5-EF8F-E6DC-6675-ADFFAAC91FDB}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Runescape DDoS V 2.7.exe" 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{DD35EEE5-EF8F-E6DC-6675-ADFFAAC91FDB} 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Active Setup\Installed Components\{DD35EEE5-EF8F-E6DC-6675-ADFFAAC91FDB}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Runescape DDoS V 2.7.exe" 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NetUpdate.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Runescape DDoS V 2.7.exe" 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetUpdate.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Runescape DDoS V 2.7.exe" 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2660 reg.exe 2732 reg.exe 2824 reg.exe 2116 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeCreateTokenPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeLockMemoryPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeMachineAccountPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeTcbPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeSecurityPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeSystemtimePrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeBackupPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeRestorePrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeShutdownPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeDebugPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeAuditPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeUndockPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeSyncAgentPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeEnableDelegationPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeManageVolumePrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeImpersonatePrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: 31 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: 32 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: 33 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: 34 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: 35 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe Token: SeDebugPrivilege 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1752 wrote to memory of 2424 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 28 PID 1752 wrote to memory of 2424 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 28 PID 1752 wrote to memory of 2424 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 28 PID 1752 wrote to memory of 2424 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 28 PID 1752 wrote to memory of 3060 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 29 PID 1752 wrote to memory of 3060 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 29 PID 1752 wrote to memory of 3060 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 29 PID 1752 wrote to memory of 3060 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 29 PID 1752 wrote to memory of 1956 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 31 PID 1752 wrote to memory of 1956 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 31 PID 1752 wrote to memory of 1956 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 31 PID 1752 wrote to memory of 1956 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 31 PID 1752 wrote to memory of 2104 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 32 PID 1752 wrote to memory of 2104 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 32 PID 1752 wrote to memory of 2104 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 32 PID 1752 wrote to memory of 2104 1752 04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe 32 PID 1956 wrote to memory of 2824 1956 cmd.exe 36 PID 1956 wrote to memory of 2824 1956 cmd.exe 36 PID 1956 wrote to memory of 2824 1956 cmd.exe 36 PID 1956 wrote to memory of 2824 1956 cmd.exe 36 PID 2424 wrote to memory of 2732 2424 cmd.exe 37 PID 2424 wrote to memory of 2732 2424 cmd.exe 37 PID 2424 wrote to memory of 2732 2424 cmd.exe 37 PID 2424 wrote to memory of 2732 2424 cmd.exe 37 PID 2104 wrote to memory of 2116 2104 cmd.exe 38 PID 2104 wrote to memory of 2116 2104 cmd.exe 38 PID 2104 wrote to memory of 2116 2104 cmd.exe 38 PID 2104 wrote to memory of 2116 2104 cmd.exe 38 PID 3060 wrote to memory of 2660 3060 cmd.exe 39 PID 3060 wrote to memory of 2660 3060 cmd.exe 39 PID 3060 wrote to memory of 2660 3060 cmd.exe 39 PID 3060 wrote to memory of 2660 3060 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2732
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\04c2b38b56160a4d891a9ee1f9e82601_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2660
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2824
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Runescape DDoS V 2.7.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Runescape DDoS V 2.7.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Runescape DDoS V 2.7.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Runescape DDoS V 2.7.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2116
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1