Analysis
-
max time kernel
141s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 22:58
Static task
static1
Behavioral task
behavioral1
Sample
5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
-
Size
474KB
-
MD5
5745cf6f1e7c4baa569c3660bff915b3
-
SHA1
1e6ac100fbc24b0fe3216341cf3dc6b518982a74
-
SHA256
5af20242a71fcf818933371a01e1881276b4454d8a32b0250cd491796716a396
-
SHA512
8879d69a36b4ad81020e5aab5bc85172171f5f273fcb08385a75ec1426766529b680d0f9b0eba1b567f513ceb1f57e67b29f5a8aa22848e71708809a205e7f66
-
SSDEEP
6144:cEYewRh3hRDJoiEOGG1c0H3OsLoiBaOSIhJM4lIg5m3Mj2PRk5Adw8lRM:cEYXnDJoi9cCeyogau8k9jSRkwjM
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe -
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
explorer.exe5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "ugwe.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w1iq3qoou5sakuw.exe 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w1iq3qoou5sakuw.exe\DisableExceptionChainValidation 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.0 = "\"C:\\ProgramData\\Google Updater 2.0\\w1iq3qoou5sakuw.exe\"" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.0 = "C:\\ProgramData\\Google Updater 2.0\\w1iq3qoou5sakuw.exe" explorer.exe -
Processes:
5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
Processes:
5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exeexplorer.exepid process 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exedescription pid process target process PID 2076 set thread context of 1500 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2784 1776 WerFault.exe explorer.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exeexplorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main explorer.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exeexplorer.exepid process 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 1776 explorer.exe 1776 explorer.exe 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 1776 explorer.exe 1776 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exepid process 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exepid process 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeDebugPrivilege 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeRestorePrivilege 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeBackupPrivilege 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeShutdownPrivilege 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeCreateTokenPrivilege 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeMachineAccountPrivilege 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeSecurityPrivilege 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: 33 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe Token: SeDebugPrivilege 1776 explorer.exe Token: SeRestorePrivilege 1776 explorer.exe Token: SeBackupPrivilege 1776 explorer.exe Token: SeLoadDriverPrivilege 1776 explorer.exe Token: SeCreatePagefilePrivilege 1776 explorer.exe Token: SeShutdownPrivilege 1776 explorer.exe Token: SeTakeOwnershipPrivilege 1776 explorer.exe Token: SeChangeNotifyPrivilege 1776 explorer.exe Token: SeCreateTokenPrivilege 1776 explorer.exe Token: SeMachineAccountPrivilege 1776 explorer.exe Token: SeSecurityPrivilege 1776 explorer.exe Token: SeAssignPrimaryTokenPrivilege 1776 explorer.exe Token: SeCreateGlobalPrivilege 1776 explorer.exe Token: 33 1776 explorer.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exedescription pid process target process PID 2076 wrote to memory of 2832 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe cmd.exe PID 2076 wrote to memory of 2832 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe cmd.exe PID 2076 wrote to memory of 2832 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe cmd.exe PID 2076 wrote to memory of 1500 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe PID 2076 wrote to memory of 1500 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe PID 2076 wrote to memory of 1500 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe PID 2076 wrote to memory of 1500 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe PID 2076 wrote to memory of 1500 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe PID 2076 wrote to memory of 1500 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe PID 2076 wrote to memory of 1500 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe PID 2076 wrote to memory of 1500 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe PID 2076 wrote to memory of 1500 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe PID 2076 wrote to memory of 1500 2076 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe PID 1500 wrote to memory of 1776 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe explorer.exe PID 1500 wrote to memory of 1776 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe explorer.exe PID 1500 wrote to memory of 1776 1500 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe"2⤵
- Sets file execution options in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 11124⤵
- Program crash
PID:2784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1776 -ip 17761⤵PID:3008
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1500-11-0x0000000002DD0000-0x0000000002E36000-memory.dmpFilesize
408KB
-
memory/1500-6-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1500-26-0x0000000002DD0000-0x0000000002E36000-memory.dmpFilesize
408KB
-
memory/1500-10-0x00000000015C0000-0x00000000015CD000-memory.dmpFilesize
52KB
-
memory/1500-12-0x0000000077334000-0x0000000077335000-memory.dmpFilesize
4KB
-
memory/1500-8-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1500-9-0x0000000002DD0000-0x0000000002E36000-memory.dmpFilesize
408KB
-
memory/1500-16-0x0000000003580000-0x000000000358C000-memory.dmpFilesize
48KB
-
memory/1500-15-0x0000000003550000-0x0000000003551000-memory.dmpFilesize
4KB
-
memory/1500-14-0x0000000002DD0000-0x0000000002E36000-memory.dmpFilesize
408KB
-
memory/1500-25-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1500-23-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/1500-4-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1776-17-0x0000000000660000-0x0000000000A94000-memory.dmpFilesize
4.2MB
-
memory/1776-19-0x0000000000660000-0x0000000000A94000-memory.dmpFilesize
4.2MB
-
memory/1776-20-0x0000000000660000-0x0000000000A93000-memory.dmpFilesize
4.2MB
-
memory/1776-21-0x0000000001200000-0x00000000012E0000-memory.dmpFilesize
896KB
-
memory/2076-1-0x0000000073B30000-0x00000000740E1000-memory.dmpFilesize
5.7MB
-
memory/2076-2-0x0000000073B30000-0x00000000740E1000-memory.dmpFilesize
5.7MB
-
memory/2076-0-0x0000000073B32000-0x0000000073B33000-memory.dmpFilesize
4KB
-
memory/2076-27-0x0000000073B30000-0x00000000740E1000-memory.dmpFilesize
5.7MB