Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2024 05:22
Behavioral task
behavioral1
Sample
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe
Resource
win7-20240221-en
8 signatures
150 seconds
General
-
Target
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe
-
Size
209KB
-
MD5
9a08e0f7225f0028a592865d73113adb
-
SHA1
7f4cd9a974d951915fa94f4bc49a976119f9908c
-
SHA256
59d39bae54401cfd6e13a81abd4167704b85b1a29d26233071998ec293a93b87
-
SHA512
445c249d07ee0dea735002b22c3bff14fa15f63bbebe7939d1599ed7d2623ac0fd73e8a829c5386a2035da52914192b874ba8640bdcdb7f13eb2c4d10d03b27d
-
SSDEEP
3072:EzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI/NpARAlF6WvqA/z7TfIvgL65O:ELV6Bta6dtJmakIM5kqWi6PL1Cbwv
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe" 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe -
Processes:
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
Processes:
flow ioc 26 0.tcp.ngrok.io 51 0.tcp.ngrok.io 66 0.tcp.ngrok.io 71 0.tcp.ngrok.io 86 0.tcp.ngrok.io 18 0.tcp.ngrok.io 34 0.tcp.ngrok.io 49 0.tcp.ngrok.io 53 0.tcp.ngrok.io 64 0.tcp.ngrok.io 88 0.tcp.ngrok.io 90 0.tcp.ngrok.io -
Drops file in Program Files directory 2 IoCs
Processes:
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\DDP Host\ddphost.exe 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe File created C:\Program Files (x86)\DDP Host\ddphost.exe 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exepid process 6088 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe 6088 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe 6088 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe 6088 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe 6088 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe 6088 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exepid process 6088 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 6088 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe Token: SeDebugPrivilege 6088 9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9a08e0f7225f0028a592865d73113adb_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/6088-0-0x00000000746C2000-0x00000000746C3000-memory.dmpFilesize
4KB
-
memory/6088-1-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/6088-2-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/6088-5-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/6088-6-0x00000000746C2000-0x00000000746C3000-memory.dmpFilesize
4KB
-
memory/6088-7-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/6088-8-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/6088-9-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB