Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe
-
Size
254KB
-
MD5
325733b87c94a4f078e125b8d8b21e1a
-
SHA1
99fa23832afd1f1ae674c7ca30de1004f6aff0ee
-
SHA256
b0dc010628c8e5309602e3f46c8ff86be2d04cdfb255cfa792938e9dc1e5b537
-
SHA512
67e337c91b7f4c9b4435d03b3917ea22d287f0bbe0001e9a709e38f87f209986d9bf127845bcc2ce7c0752c9118049c236b030c70058734d47ba3807c26333d7
-
SSDEEP
1536:gNI/c0ZS3LhbcAuF0x6PF9Dnx5YVa5CsbJqUHtgttDjxHItRh:gN4U7h5mDnx5fblHqfZotRh
Score
10/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" winsvcs.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winsvcs.exe -
Executes dropped EXE 1 IoCs
pid Process 2228 winsvcs.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winsvcs.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\T50696040382020\\winsvcs.exe" 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\T50696040382020\\winsvcs.exe" 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\T50696040382020\winsvcs.exe 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe File opened for modification C:\Windows\T50696040382020\winsvcs.exe 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe File opened for modification C:\Windows\T50696040382020 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3296 4472 WerFault.exe 82 -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe 2228 winsvcs.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4472 wrote to memory of 2228 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 88 PID 4472 wrote to memory of 2228 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 88 PID 4472 wrote to memory of 2228 4472 325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\325733b87c94a4f078e125b8d8b21e1a_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\T50696040382020\winsvcs.exeC:\Windows\T50696040382020\winsvcs.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
PID:2228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 5802⤵
- Program crash
PID:3296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4472 -ip 44721⤵PID:2044
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD5325733b87c94a4f078e125b8d8b21e1a
SHA199fa23832afd1f1ae674c7ca30de1004f6aff0ee
SHA256b0dc010628c8e5309602e3f46c8ff86be2d04cdfb255cfa792938e9dc1e5b537
SHA51267e337c91b7f4c9b4435d03b3917ea22d287f0bbe0001e9a709e38f87f209986d9bf127845bcc2ce7c0752c9118049c236b030c70058734d47ba3807c26333d7