Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 11:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe
- Size 1.1MB
- Sample240603-m6abdade84
- SHA256 d6540b8dd4db20c1e7d6d31d6a2fad0702f4186a101ebdd20ecde98ccc36a0e0
- MD5 918c056ba9320cda412b6713db3076ef
- SHA1 6d635323a980f11e0d56d0bc362ec54ce8cd0e11
- SHA512 a95f1856621f95387bbadc9fc25d94965f6d727f4b9d48f34f1a98dc5e6bc4a2d4fae9540dd0baaee636af6f3856b1a27ba269f60f5402dc46e8a417e3b0af1f
- SSDEEP 24576:9DLgo6Zf9K3EyfbHguMzxmLdDXZ/w54zskCVg:FL/6ZfM0ElDXq4
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uifckfkgzdwe\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\etiuylbpvvle" 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4732 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 2696 3676 WerFault.exe 80 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe Token: SeLoadDriverPrivilege 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe Token: SeBackupPrivilege 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe Token: SeRestorePrivilege 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe Token: 33 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3676 wrote to memory of 4732 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 81 PID 3676 wrote to memory of 4732 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 81 PID 3676 wrote to memory of 4732 3676 918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\918c056ba9320cda412b6713db3076ef_JaffaCakes118.exe"1⤵
- Sets service image path in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe delete uifckfkgzdwe2⤵
- Launches sc.exe
PID:4732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 14082⤵
- Program crash
PID:2696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3676 -ip 36761⤵PID:1556
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1