Analysis
-
max time kernel
148s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 12:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe
-
Size
64KB
-
MD5
05fbc3e2f44bd89cf12279a1d04d8724
-
SHA1
27959ca5cf68c1efa4c4199c44de19921af78bcf
-
SHA256
d32853505240162bed12d8cf9f5981eb786c40d32b6456efd304dae503c390bf
-
SHA512
3662dd6747a4eec0c4b8b886a3b01875dce0390de5a5e08a1d95bf76665d62b51465653ab5327ff2ad22d5025e367bcc32a654248f2ffccc837a195c1a42e423
-
SSDEEP
768:6JSwpbhhMwNmF1PQVZsDA1fFYM9M2AT9GhEWcbk7Wcbko0uJv:6JSA0wu18fL22ATBWcbqWcbMuJv
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" Fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" SVIQ.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" dc.exe -
Executes dropped EXE 3 IoCs
pid Process 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe -
Loads dropped DLL 2 IoCs
pid Process 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" dc.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\Win.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe Fun.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe SVIQ.EXE File created C:\Windows\SysWOW64\WinSit.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe dc.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe dc.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe Fun.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe SVIQ.EXE -
Drops file in Windows directory 36 IoCs
description ioc Process File opened for modification C:\Windows\inf\Other.exe dc.exe File opened for modification C:\Windows\Help\Other.exe dc.exe File opened for modification C:\Windows\SVIQ.EXE dc.exe File created C:\Windows\system\Fun.exe dc.exe File opened for modification C:\Windows\Help\Other.exe Fun.exe File opened for modification C:\Windows\system\Fun.exe Fun.exe File created C:\Windows\inf\Other.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File created C:\Windows\Help\Other.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\system\Fun.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\dc.exe Fun.exe File opened for modification C:\Windows\dc.exe SVIQ.EXE File opened for modification C:\Windows\Help\Other.exe SVIQ.EXE File created C:\Windows\dc.exe dc.exe File opened for modification C:\Windows\dc.exe dc.exe File opened for modification C:\Windows\inf\Other.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File created C:\Windows\system\Fun.exe SVIQ.EXE File created C:\Windows\dc.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\wininit.ini 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\inf\Other.exe Fun.exe File opened for modification C:\Windows\wininit.ini Fun.exe File opened for modification C:\Windows\wininit.ini SVIQ.EXE File created C:\Windows\SVIQ.EXE dc.exe File opened for modification C:\Windows\SVIQ.EXE SVIQ.EXE File created C:\Windows\SVIQ.EXE 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\dc.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\Help\Other.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File created C:\Windows\system\Fun.exe Fun.exe File opened for modification C:\Windows\wininit.ini dc.exe File opened for modification C:\Windows\system\Fun.exe SVIQ.EXE File opened for modification C:\Windows\system\Fun.exe dc.exe File created C:\Windows\system\Fun.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\SVIQ.EXE Fun.exe File created C:\Windows\SVIQ.EXE SVIQ.EXE File opened for modification C:\Windows\inf\Other.exe SVIQ.EXE File opened for modification C:\Windows\SVIQ.exe SVIQ.EXE File opened for modification C:\Windows\SVIQ.EXE 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe 2972 SVIQ.EXE 2488 dc.exe 2344 Fun.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 2344 Fun.exe 2344 Fun.exe 2972 SVIQ.EXE 2972 SVIQ.EXE 2488 dc.exe 2488 dc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2344 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 28 PID 2932 wrote to memory of 2344 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 28 PID 2932 wrote to memory of 2344 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 28 PID 2932 wrote to memory of 2344 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 28 PID 2344 wrote to memory of 2972 2344 Fun.exe 29 PID 2344 wrote to memory of 2972 2344 Fun.exe 29 PID 2344 wrote to memory of 2972 2344 Fun.exe 29 PID 2344 wrote to memory of 2972 2344 Fun.exe 29 PID 2932 wrote to memory of 2488 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 30 PID 2932 wrote to memory of 2488 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 30 PID 2932 wrote to memory of 2488 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 30 PID 2932 wrote to memory of 2488 2932 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\system\Fun.exeC:\Windows\system\Fun.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SVIQ.EXEC:\Windows\SVIQ.EXE3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2972
-
-
-
C:\Windows\dc.exeC:\Windows\dc.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD505fbc3e2f44bd89cf12279a1d04d8724
SHA127959ca5cf68c1efa4c4199c44de19921af78bcf
SHA256d32853505240162bed12d8cf9f5981eb786c40d32b6456efd304dae503c390bf
SHA5123662dd6747a4eec0c4b8b886a3b01875dce0390de5a5e08a1d95bf76665d62b51465653ab5327ff2ad22d5025e367bcc32a654248f2ffccc837a195c1a42e423
-
Filesize
41B
MD5e839977c0d22c9aa497b0b1d90d8a372
SHA1b5048e501399138796b38f3d3666e1a88c397e83
SHA256478db7f82fd7ef4860f7acd2f534ec303175500d7f4e1e36161d31c900d234e2
SHA5124c8ba5a26b6f738f8d25c32d019cee63e9a32d28e3aeb8fe31b965d7603c24a3539e469c8eb569747b47dadc9c43cdd1066ddb37ed8138bee5d0c74b5d0c275d