Resubmissions
15-05-2024 07:41
240515-jjclfaff64 1015-05-2024 07:38
240515-jgfkbafe78 415-05-2024 07:26
240515-h9jxrsfa2t 10Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
15-05-2024 07:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45193536497856842273bcf3ba3eed80_JaffaCakes118.exe
Resource
win10-20240404-en
windows10-1703-x64
12 signatures
150 seconds
General
-
Target
45193536497856842273bcf3ba3eed80_JaffaCakes118.exe
-
Size
360KB
-
MD5
45193536497856842273bcf3ba3eed80
-
SHA1
9936812c27e92c8f7f7183ed3a8730ea1c6e167b
-
SHA256
9bf59f52f58052e0644fc5d0a8e9efcc8b7db586a365bd8611228c42ed4d0332
-
SHA512
3ea4cb9916f01b00d7dd73fef6a9006d1c521a225037a44a136991d98db1a0abb74fbc2a09dd2905e2404ca2956382dbb274e346e84be99bdb0377a3ca44f785
-
SSDEEP
6144:gZtBZh5vTOAWJx4u1l05Lpm+SemsrbK9XbgwJU2WWIBReISOuO8I:Qn7vSr4+sLwRnXbg4U2WWyN
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exePOWERPNT.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString POWERPNT.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
POWERPNT.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU POWERPNT.EXE -
Modifies registry class 1 IoCs
Processes:
taskmgr.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
vlc.exePOWERPNT.EXEpid Process 4404 vlc.exe 3116 POWERPNT.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid Process 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
taskmgr.exevlc.exepid Process 3164 taskmgr.exe 4404 vlc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid Process Token: SeDebugPrivilege 3164 taskmgr.exe Token: SeSystemProfilePrivilege 3164 taskmgr.exe Token: SeCreateGlobalPrivilege 3164 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe 3164 taskmgr.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
vlc.exePOWERPNT.EXEpid Process 4404 vlc.exe 3116 POWERPNT.EXE 3116 POWERPNT.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\45193536497856842273bcf3ba3eed80_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45193536497856842273bcf3ba3eed80_JaffaCakes118.exe"1⤵PID:3660
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3164
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1880
-
C:\Windows\System32\ksdydr.exe"C:\Windows\System32\ksdydr.exe"1⤵PID:1372
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\WatchSuspend.mov"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4404
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\GrantExport.ppsx" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3116