Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe
-
Size
866KB
-
MD5
942b292951ef2f967d1f8f865280ffdb
-
SHA1
3da41fb65bcd8243eef91b6135975376badfbab2
-
SHA256
5d5ab41fe7d312908eeed82b496b92f5982decf1efc57ab492840ca00efb0ef4
-
SHA512
b481d4b3adff6a8b2f669da31696e4c2320186f4d92ef53641b5d184657c9f808d091dc71624711fcedb317eac5c87a60baec1ab866f92ae33d6d64ddce84ea6
-
SSDEEP
24576:GtHz8zgzexxRtb8ZoQrQZ4p3b/sZOPxR:Qz8zhxxXb8ZlrQ2pLkeR
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3364 services.exe 4900 svchost.exe 2352 svchost.exe -
resource yara_rule behavioral2/files/0x000700000002354a-9.dat upx behavioral2/memory/2352-12-0x00000000005C0000-0x00000000007CE000-memory.dmp upx behavioral2/memory/2352-28-0x00000000005C0000-0x00000000007CE000-memory.dmp upx behavioral2/memory/2352-40-0x00000000005C0000-0x00000000007CE000-memory.dmp upx behavioral2/memory/2352-41-0x00000000005C0000-0x00000000007CE000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\H18O9pAp\ services.exe File created C:\Program Files\H18O9pAp\cfg.db services.exe File opened for modification C:\Program Files\H18O9pAp\cfg.db services.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\CLSID\{A4FC6719-AFD5-4F8E-8138-B35FA78CD671} svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\CLSID\{A4FC6719-AFD5-4F8E-8138-B35FA78CD671}\ = "59330" svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4900 svchost.exe 4900 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe 4900 svchost.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 3364 services.exe Token: SeDebugPrivilege 2352 svchost.exe Token: SeDebugPrivilege 2352 svchost.exe Token: SeDebugPrivilege 2352 svchost.exe Token: SeDebugPrivilege 2352 svchost.exe Token: SeDebugPrivilege 2352 svchost.exe Token: SeDebugPrivilege 2352 svchost.exe Token: SeDebugPrivilege 2352 svchost.exe Token: SeDebugPrivilege 2352 svchost.exe Token: SeDebugPrivilege 2352 svchost.exe Token: SeDebugPrivilege 2352 svchost.exe Token: SeDebugPrivilege 2352 svchost.exe Token: SeDebugPrivilege 2352 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2520 wrote to memory of 3364 2520 942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe 92 PID 2520 wrote to memory of 3364 2520 942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe 92 PID 2520 wrote to memory of 3364 2520 942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe 92 PID 2520 wrote to memory of 4900 2520 942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe 93 PID 2520 wrote to memory of 4900 2520 942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe 93 PID 2520 wrote to memory of 4900 2520 942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe 93 PID 2520 wrote to memory of 2352 2520 942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe 94 PID 2520 wrote to memory of 2352 2520 942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe 94 PID 2520 wrote to memory of 2352 2520 942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\942b292951ef2f967d1f8f865280ffdb_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\22398\services.exeC:\Users\Admin\AppData\Local\Temp\22398\services.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3364
-
-
C:\Users\Admin\AppData\Local\Temp\22398\svchost.exeC:\Users\Admin\AppData\Local\Temp\22398\svchost.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4900
-
-
C:\Users\Admin\AppData\Local\Temp\223982\svchost.exeC:\Users\Admin\AppData\Local\Temp\223982\svchost.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3888,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:81⤵PID:2392
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5d0dc5f6c7dd51a8b7d6f0a7772964b79
SHA147f0f894c8ae5f79255289eee396cc9587d1d22e
SHA256b2d11a62bf2de3964a1827c154baf7bf95a21249394b6d11151d1763fc7f5bc6
SHA512b8422a7d15128503e665afc66f8971a7957058e849cac0e2d66533a5e06c7aecc8b15361065adebf740d4a9e9d9c5267bc018db4331d169b2527fe043de623d6
-
Filesize
340KB
MD5cd0b75bc3eb6ca85cacce02aea253055
SHA1931dcdba1ef212021515fb31336038397fba9f64
SHA256bfda9d63692f86187a3429f44d805af6ff505c7bf02cd452b3869f5f217cfff3
SHA512e8d9ce763abed8c0fc004d53afb3ce907c70e201a47d21c3de725060bf7f1ade94f8384532e6f0f812b0521e22346613e0bb2019462befa5cc4117b1290fd73c
-
Filesize
342KB
MD556345b57ee7f8e9efbe052a123c54131
SHA195c6dad4ae221b0d4a4ccd4d4185e052e878dbdb
SHA256d8c1709c361778dd4b9318dabdcb7c1e36bfb57ecd44eae45fc8388ea99b23cb
SHA512b76ff393606e78b4f383decb7c7fba801c4b1605414e9721a1d98c8a6d3238477aee9d2b146cbb443ecb22ae727baf20549e41d56def7bf9ef68ee638ed58602
-
Filesize
176KB
MD5a0a03eae129b94539e33e885ac5d1316
SHA17e5aabb819bcbda26bd0f4206ba54503e0b2e0fa
SHA256ca994d295719cf147b8493fb98af6198563808a750439f230bfc910288a059c2
SHA512fb80158ca870fef69305c1d4a21cd0c16c2cc93b78502c22ab70b2bec1b56ca9610c801190678f4ad19ae57d3bb8930d88b2cc6800832a8b41b75eb36f62bd43