Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 07:48
Static task
static1
Behavioral task
behavioral1
Sample
b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe
-
Size
586KB
-
MD5
b26c6f36a8711168dc8d2882a6cab0c2
-
SHA1
e133a7dad21664672df96f0e6c956effe2ac7350
-
SHA256
0f6c9c6fbd87f9ee7bb66f6d9302f0334c3b16a2a4c2482d3db0ff117fcb1e06
-
SHA512
f865d9cd05796cd4dfb69e1a9748b14c9d3ca49d29f5dee1bc8df367dc9f141ac1208a13a986f18963df2b70ff56aa76e7f2b0c7d9e2199ee472e24a24934910
-
SSDEEP
12288:ZjY1mBgD6V65x0RfcbA+y2EoekTDWXDe12aU6uW:ZjY1mNV65x0ZoAR2XNfWXi12ag
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
litegen.exelitegen.exepid process 2320 litegen.exe 1864 litegen.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2928 cmd.exe -
Processes:
resource yara_rule behavioral1/memory/1864-17-0x0000000000080000-0x0000000000163000-memory.dmp upx behavioral1/memory/1864-19-0x0000000000080000-0x0000000000163000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
litegen.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\lite = "C:\\Users\\Admin\\AppData\\Local\\litegen.exe -boot" litegen.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
litegen.exedescription pid process target process PID 2320 set thread context of 1864 2320 litegen.exe litegen.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exelitegen.exedescription pid process Token: SeDebugPrivilege 1964 b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe Token: 33 1964 b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1964 b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe Token: SeDebugPrivilege 2320 litegen.exe Token: 33 2320 litegen.exe Token: SeIncBasePriorityPrivilege 2320 litegen.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.execmd.exelitegen.exedescription pid process target process PID 1964 wrote to memory of 2668 1964 b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe cmd.exe PID 1964 wrote to memory of 2668 1964 b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe cmd.exe PID 1964 wrote to memory of 2668 1964 b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe cmd.exe PID 1964 wrote to memory of 2668 1964 b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe cmd.exe PID 1964 wrote to memory of 2928 1964 b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe cmd.exe PID 1964 wrote to memory of 2928 1964 b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe cmd.exe PID 1964 wrote to memory of 2928 1964 b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe cmd.exe PID 1964 wrote to memory of 2928 1964 b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe cmd.exe PID 2928 wrote to memory of 2320 2928 cmd.exe litegen.exe PID 2928 wrote to memory of 2320 2928 cmd.exe litegen.exe PID 2928 wrote to memory of 2320 2928 cmd.exe litegen.exe PID 2928 wrote to memory of 2320 2928 cmd.exe litegen.exe PID 2320 wrote to memory of 1864 2320 litegen.exe litegen.exe PID 2320 wrote to memory of 1864 2320 litegen.exe litegen.exe PID 2320 wrote to memory of 1864 2320 litegen.exe litegen.exe PID 2320 wrote to memory of 1864 2320 litegen.exe litegen.exe PID 2320 wrote to memory of 1864 2320 litegen.exe litegen.exe PID 2320 wrote to memory of 1864 2320 litegen.exe litegen.exe PID 2320 wrote to memory of 1864 2320 litegen.exe litegen.exe PID 2320 wrote to memory of 1864 2320 litegen.exe litegen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\b26c6f36a8711168dc8d2882a6cab0c2_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\litegen.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\litegen.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\litegen.exe"C:\Users\Admin\AppData\Local\litegen.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\litegen.exe"C:\Users\Admin\AppData\Local\litegen.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\litegen.exeFilesize
586KB
MD5b26c6f36a8711168dc8d2882a6cab0c2
SHA1e133a7dad21664672df96f0e6c956effe2ac7350
SHA2560f6c9c6fbd87f9ee7bb66f6d9302f0334c3b16a2a4c2482d3db0ff117fcb1e06
SHA512f865d9cd05796cd4dfb69e1a9748b14c9d3ca49d29f5dee1bc8df367dc9f141ac1208a13a986f18963df2b70ff56aa76e7f2b0c7d9e2199ee472e24a24934910
-
memory/1864-19-0x0000000000080000-0x0000000000163000-memory.dmpFilesize
908KB
-
memory/1864-15-0x0000000000080000-0x0000000000163000-memory.dmpFilesize
908KB
-
memory/1864-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1864-17-0x0000000000080000-0x0000000000163000-memory.dmpFilesize
908KB
-
memory/1964-8-0x0000000074C60000-0x000000007534E000-memory.dmpFilesize
6.9MB
-
memory/1964-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmpFilesize
4KB
-
memory/1964-7-0x0000000074C6E000-0x0000000074C6F000-memory.dmpFilesize
4KB
-
memory/1964-11-0x0000000074C60000-0x000000007534E000-memory.dmpFilesize
6.9MB
-
memory/1964-4-0x0000000074C60000-0x000000007534E000-memory.dmpFilesize
6.9MB
-
memory/1964-3-0x0000000074C60000-0x000000007534E000-memory.dmpFilesize
6.9MB
-
memory/1964-2-0x0000000000320000-0x000000000033E000-memory.dmpFilesize
120KB
-
memory/1964-1-0x0000000000980000-0x0000000000A18000-memory.dmpFilesize
608KB
-
memory/2320-13-0x00000000003B0000-0x0000000000448000-memory.dmpFilesize
608KB
-
memory/2320-14-0x00000000005B0000-0x00000000005BA000-memory.dmpFilesize
40KB