Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 14:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe
- Size 160KB
- Sample240613-rzpvpsshpe
- SHA256 d71325d6cd03bc49ec0b3f3eb66984c605a02064fe8cf2bfd608769746b4b0b2
- MD5 a6100c665fd57bfde92a882459e042ab
- SHA1 ef38713b3079724706c9eba5aebbae7eb474fd6a
- SHA512 87df7eae4082f83b3ee4870f75c9528a49151892e4512330d1984361303221e4048158a828e23ad89cf7b14d6239da590f27b2f55ff18bfc52abf3d20d37d136
- SSDEEP 1536:bXIDzUOhbJF7k5GYG7NYonizzTIJUW5k+iQcxbT5ZUs8jcdaflGRGr8XekUToiDw:TIgOh79yoizAk+i7T9adGRGrqmuj
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" winsvcs.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winsvcs.exe - Executes dropped EXE 1 IoCs
pid Process 3856 winsvcs.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winsvcs.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\T40506932020485930\\winsvcs.exe" a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\T40506932020485930\\winsvcs.exe" a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\T40506932020485930\winsvcs.exe a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe File opened for modification C:\Windows\T40506932020485930\winsvcs.exe a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe File opened for modification C:\Windows\T40506932020485930 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe - Program crash 1 IoCs
pid pid_target Process procid_target 928 4672 WerFault.exe 79 - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe 3856 winsvcs.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4672 wrote to memory of 3856 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 80 PID 4672 wrote to memory of 3856 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 80 PID 4672 wrote to memory of 3856 4672 a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a6100c665fd57bfde92a882459e042ab_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\T40506932020485930\winsvcs.exeC:\Windows\T40506932020485930\winsvcs.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
PID:3856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 5282⤵
- Program crash
PID:928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4672 -ip 46721⤵PID:1036
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\T40506932020485930\winsvcs.exe
- Size 160KB
- SHA256 d71325d6cd03bc49ec0b3f3eb66984c605a02064fe8cf2bfd608769746b4b0b2
- MD5 a6100c665fd57bfde92a882459e042ab
- SHA1 ef38713b3079724706c9eba5aebbae7eb474fd6a
- SHA512 87df7eae4082f83b3ee4870f75c9528a49151892e4512330d1984361303221e4048158a828e23ad89cf7b14d6239da590f27b2f55ff18bfc52abf3d20d37d136
- SSDEEP 1536:bXIDzUOhbJF7k5GYG7NYonizzTIJUW5k+iQcxbT5ZUs8jcdaflGRGr8XekUToiDw:TIgOh79yoizAk+i7T9adGRGrqmuj
- MD5 SHA1 SHA512 SSDEEP