Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 14:23
Static task
static1
Behavioral task
behavioral1
Sample
7d480f0fcc57fd006d6d980b38f72b54_JaffaCakes118.msi
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
7d480f0fcc57fd006d6d980b38f72b54_JaffaCakes118.msi
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
7d480f0fcc57fd006d6d980b38f72b54_JaffaCakes118.msi
-
Size
1.1MB
-
MD5
7d480f0fcc57fd006d6d980b38f72b54
-
SHA1
f5e9963704928d010d13c4a2ca827495d482f89c
-
SHA256
f5e0b11df76f0c7c385a8f57c8767a086b8e4097c049a951dddf52e59aaabfa7
-
SHA512
5f74a77fb26ed66e6766e90af756f8ea060b334b3a3bd9784a6e8468a793877cc3b684d7030765c4fec76495159a945db215e69283c8c4b5f0db91e67c025ddb
-
SSDEEP
24576:LEvg3C9osUr0WcVbpy27X9Gf5gRiYYXGsr07mStOfcLsALYZ+TwscbUoTS:LEI39Gfa2s/GsMFTw
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI3B6B.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI3BBB.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f763a71.msi msiexec.exe File opened for modification C:\Windows\Installer\f763a71.msi msiexec.exe File created C:\Windows\Installer\f763a74.ipi msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 2948 MSI3BBB.tmp -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1636 msiexec.exe 1636 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeShutdownPrivilege 2972 msiexec.exe Token: SeIncreaseQuotaPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 1636 msiexec.exe Token: SeTakeOwnershipPrivilege 1636 msiexec.exe Token: SeSecurityPrivilege 1636 msiexec.exe Token: SeCreateTokenPrivilege 2972 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2972 msiexec.exe Token: SeLockMemoryPrivilege 2972 msiexec.exe Token: SeIncreaseQuotaPrivilege 2972 msiexec.exe Token: SeMachineAccountPrivilege 2972 msiexec.exe Token: SeTcbPrivilege 2972 msiexec.exe Token: SeSecurityPrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeLoadDriverPrivilege 2972 msiexec.exe Token: SeSystemProfilePrivilege 2972 msiexec.exe Token: SeSystemtimePrivilege 2972 msiexec.exe Token: SeProfSingleProcessPrivilege 2972 msiexec.exe Token: SeIncBasePriorityPrivilege 2972 msiexec.exe Token: SeCreatePagefilePrivilege 2972 msiexec.exe Token: SeCreatePermanentPrivilege 2972 msiexec.exe Token: SeBackupPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeShutdownPrivilege 2972 msiexec.exe Token: SeDebugPrivilege 2972 msiexec.exe Token: SeAuditPrivilege 2972 msiexec.exe Token: SeSystemEnvironmentPrivilege 2972 msiexec.exe Token: SeChangeNotifyPrivilege 2972 msiexec.exe Token: SeRemoteShutdownPrivilege 2972 msiexec.exe Token: SeUndockPrivilege 2972 msiexec.exe Token: SeSyncAgentPrivilege 2972 msiexec.exe Token: SeEnableDelegationPrivilege 2972 msiexec.exe Token: SeManageVolumePrivilege 2972 msiexec.exe Token: SeImpersonatePrivilege 2972 msiexec.exe Token: SeCreateGlobalPrivilege 2972 msiexec.exe Token: SeBackupPrivilege 1908 vssvc.exe Token: SeRestorePrivilege 1908 vssvc.exe Token: SeAuditPrivilege 1908 vssvc.exe Token: SeBackupPrivilege 1636 msiexec.exe Token: SeRestorePrivilege 1636 msiexec.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeLoadDriverPrivilege 2800 DrvInst.exe Token: SeLoadDriverPrivilege 2800 DrvInst.exe Token: SeLoadDriverPrivilege 2800 DrvInst.exe Token: SeRestorePrivilege 1636 msiexec.exe Token: SeTakeOwnershipPrivilege 1636 msiexec.exe Token: SeRestorePrivilege 1636 msiexec.exe Token: SeTakeOwnershipPrivilege 1636 msiexec.exe Token: SeRestorePrivilege 1636 msiexec.exe Token: SeTakeOwnershipPrivilege 1636 msiexec.exe Token: SeRestorePrivilege 1636 msiexec.exe Token: SeTakeOwnershipPrivilege 1636 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2948 MSI3BBB.tmp -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1636 wrote to memory of 2948 1636 msiexec.exe 32 PID 1636 wrote to memory of 2948 1636 msiexec.exe 32 PID 1636 wrote to memory of 2948 1636 msiexec.exe 32 PID 1636 wrote to memory of 2948 1636 msiexec.exe 32 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\7d480f0fcc57fd006d6d980b38f72b54_JaffaCakes118.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2972
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\Installer\MSI3BBB.tmp"C:\Windows\Installer\MSI3BBB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2948
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A0" "00000000000003A8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD588b8f7c03ae0d0cdba24adbafd807727
SHA1cc106478bcc678d16b001f4f1d35ed5e142c8312
SHA256501318bc1ac43bbefa39dc8447e51691863e1b18de7577c62dd946424492eada
SHA512a5c2d46c0592bc15072365ee4c4c6e291e19a5e1cec7cb92e52713ee4d48523170cf7afd6e2c6b5d3c2849dd776a4e243a1c2fcef5a6343ecd97f48435546dfc