Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 12:06
Static task
static1
Behavioral task
behavioral1
Sample
4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
4afb95d53f83e1dea370b2f501307dda
-
SHA1
25bdb482d40b3b9d29b36774c4bcc3fd090f0624
-
SHA256
51d0bc63f05586fc726d57103a8067636dcfcef391cc15025cde2d82cc83dcfd
-
SHA512
f8f6297f44dd6c898d32b03ec98a2ad43058850047d04524cbbe9de78afb59f013330f92e9006430a5414c07ce10a9fc2cd3b93d41d8b29899bfc3957199ec36
-
SSDEEP
12288:RFfwcHcu8pMkZ3Fn9d+Vd3SUZ+7EeI1x7f7V3+hT6DaRWz58kc+1xy8SyG54f:RJcu8pl9d+VdCUhN1SsNK+1pSyw4f
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" services.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" services.exe -
Modifies Installed Components in the registry 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ services.exe -
resource yara_rule behavioral1/files/0x0038000000014230-24.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 2976 fservice.exe 2988 services.exe -
Loads dropped DLL 6 IoCs
pid Process 2280 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe 2280 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe 2988 services.exe 2988 services.exe 2976 fservice.exe 2280 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ services.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fservice.exe 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe File created C:\Windows\SysWOW64\fservice.exe fservice.exe File opened for modification C:\Windows\SysWOW64\fservice.exe fservice.exe File created C:\Windows\SysWOW64\winkey.dll services.exe File created C:\Windows\SysWOW64\reginv.dll services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\system\sservice.exe 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe File opened for modification C:\Windows\system\sservice.exe 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe File created C:\Windows\services.exe fservice.exe File opened for modification C:\Windows\services.exe fservice.exe File created C:\Windows\system\sservice.exe fservice.exe File opened for modification C:\Windows\system\sservice.exe fservice.exe File created C:\Windows\system\sservice.exe services.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2988 services.exe 2988 services.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2976 2280 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe 28 PID 2280 wrote to memory of 2976 2280 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe 28 PID 2280 wrote to memory of 2976 2280 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe 28 PID 2280 wrote to memory of 2976 2280 4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe 28 PID 2976 wrote to memory of 2988 2976 fservice.exe 29 PID 2976 wrote to memory of 2988 2976 fservice.exe 29 PID 2976 wrote to memory of 2988 2976 fservice.exe 29 PID 2976 wrote to memory of 2988 2976 fservice.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4afb95d53f83e1dea370b2f501307dda_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\fservice.exeC:\Windows\system32\fservice.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\services.exeC:\Windows\services.exe -XP3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2988
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD54afb95d53f83e1dea370b2f501307dda
SHA125bdb482d40b3b9d29b36774c4bcc3fd090f0624
SHA25651d0bc63f05586fc726d57103a8067636dcfcef391cc15025cde2d82cc83dcfd
SHA512f8f6297f44dd6c898d32b03ec98a2ad43058850047d04524cbbe9de78afb59f013330f92e9006430a5414c07ce10a9fc2cd3b93d41d8b29899bfc3957199ec36
-
Filesize
36KB
MD5562e0d01d6571fa2251a1e9f54c6cc69
SHA183677ad3bc630aa6327253c7b3deffbd4a8ce905
SHA256c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6
SHA512166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea
-
Filesize
13KB
MD5b4c72da9fd1a0dcb0698b7da97daa0cd
SHA1b25a79e8ea4c723c58caab83aed6ea48de7ed759
SHA25645d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f
SHA512f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066