Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-06-2024 05:22
Behavioral task
behavioral1
Sample
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
-
Target
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe
-
Size
209KB
-
MD5
9a08e0f7225f0028a592865d73113adb
-
SHA1
7f4cd9a974d951915fa94f4bc49a976119f9908c
-
SHA256
59d39bae54401cfd6e13a81abd4167704b85b1a29d26233071998ec293a93b87
-
SHA512
445c249d07ee0dea735002b22c3bff14fa15f63bbebe7939d1599ed7d2623ac0fd73e8a829c5386a2035da52914192b874ba8640bdcdb7f13eb2c4d10d03b27d
-
SSDEEP
3072:EzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI/NpARAlF6WvqA/z7TfIvgL65O:ELV6Bta6dtJmakIM5kqWi6PL1Cbwv
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe" 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe -
Processes:
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
Processes:
flow ioc 15 0.tcp.ngrok.io 29 0.tcp.ngrok.io 33 0.tcp.ngrok.io 2 0.tcp.ngrok.io 11 0.tcp.ngrok.io 13 0.tcp.ngrok.io 4 0.tcp.ngrok.io 20 0.tcp.ngrok.io 22 0.tcp.ngrok.io 40 0.tcp.ngrok.io 38 0.tcp.ngrok.io 42 0.tcp.ngrok.io 6 0.tcp.ngrok.io 24 0.tcp.ngrok.io 31 0.tcp.ngrok.io -
Drops file in Program Files directory 2 IoCs
Processes:
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exedescription ioc process File created C:\Program Files (x86)\DDP Service\ddpsv.exe 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exepid process 2180 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe 2180 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe 2180 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe 2180 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe 2180 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exepid process 2180 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2180 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe Token: SeDebugPrivilege 2180 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2180-0-0x00000000740A1000-0x00000000740A2000-memory.dmpFilesize
4KB
-
memory/2180-1-0x00000000740A0000-0x000000007464B000-memory.dmpFilesize
5.7MB
-
memory/2180-2-0x00000000740A0000-0x000000007464B000-memory.dmpFilesize
5.7MB
-
memory/2180-5-0x00000000740A0000-0x000000007464B000-memory.dmpFilesize
5.7MB