Analysis
-
max time kernel
149s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 12:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe
-
Size
64KB
-
MD5
05fbc3e2f44bd89cf12279a1d04d8724
-
SHA1
27959ca5cf68c1efa4c4199c44de19921af78bcf
-
SHA256
d32853505240162bed12d8cf9f5981eb786c40d32b6456efd304dae503c390bf
-
SHA512
3662dd6747a4eec0c4b8b886a3b01875dce0390de5a5e08a1d95bf76665d62b51465653ab5327ff2ad22d5025e367bcc32a654248f2ffccc837a195c1a42e423
-
SSDEEP
768:6JSwpbhhMwNmF1PQVZsDA1fFYM9M2AT9GhEWcbk7Wcbko0uJv:6JSA0wu18fL22ATBWcbqWcbMuJv
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" Fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" SVIQ.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" dc.exe -
Executes dropped EXE 3 IoCs
pid Process 3308 Fun.exe 2692 SVIQ.EXE 740 dc.exe -
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" dc.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\Win.exe SVIQ.EXE File opened for modification C:\Windows\SysWOW64\config\Win.exe dc.exe File created C:\Windows\SysWOW64\WinSit.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe SVIQ.EXE File opened for modification C:\Windows\SysWOW64\config\Win.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe Fun.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe Fun.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe dc.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File created C:\Windows\SysWOW64\config\Win.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe -
Drops file in Windows directory 36 IoCs
description ioc Process File opened for modification C:\Windows\SVIQ.exe SVIQ.EXE File created C:\Windows\system\Fun.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\wininit.ini 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File created C:\Windows\dc.exe dc.exe File opened for modification C:\Windows\system\Fun.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\wininit.ini Fun.exe File created C:\Windows\system\Fun.exe SVIQ.EXE File opened for modification C:\Windows\wininit.ini SVIQ.EXE File created C:\Windows\system\Fun.exe dc.exe File opened for modification C:\Windows\system\Fun.exe dc.exe File opened for modification C:\Windows\SVIQ.EXE 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\Help\Other.exe Fun.exe File opened for modification C:\Windows\Help\Other.exe SVIQ.EXE File created C:\Windows\SVIQ.EXE SVIQ.EXE File opened for modification C:\Windows\Help\Other.exe dc.exe File opened for modification C:\Windows\SVIQ.EXE SVIQ.EXE File created C:\Windows\system\Fun.exe Fun.exe File opened for modification C:\Windows\dc.exe SVIQ.EXE File opened for modification C:\Windows\inf\Other.exe dc.exe File opened for modification C:\Windows\inf\Other.exe SVIQ.EXE File opened for modification C:\Windows\wininit.ini dc.exe File created C:\Windows\SVIQ.EXE 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File created C:\Windows\inf\Other.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\SVIQ.EXE Fun.exe File opened for modification C:\Windows\dc.exe dc.exe File opened for modification C:\Windows\dc.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\inf\Other.exe Fun.exe File opened for modification C:\Windows\system\Fun.exe SVIQ.EXE File opened for modification C:\Windows\Help\Other.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\dc.exe Fun.exe File created C:\Windows\SVIQ.EXE dc.exe File opened for modification C:\Windows\system\Fun.exe Fun.exe File opened for modification C:\Windows\SVIQ.EXE dc.exe File created C:\Windows\dc.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File opened for modification C:\Windows\inf\Other.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe File created C:\Windows\Help\Other.exe 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 3308 Fun.exe 3308 Fun.exe 2692 SVIQ.EXE 2692 SVIQ.EXE 740 dc.exe 740 dc.exe 3308 Fun.exe 3308 Fun.exe 2692 SVIQ.EXE 2692 SVIQ.EXE 740 dc.exe 740 dc.exe 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 3308 Fun.exe 3308 Fun.exe 2692 SVIQ.EXE 2692 SVIQ.EXE 740 dc.exe 740 dc.exe 3308 Fun.exe 3308 Fun.exe 2692 SVIQ.EXE 2692 SVIQ.EXE 740 dc.exe 740 dc.exe 3308 Fun.exe 3308 Fun.exe 2692 SVIQ.EXE 2692 SVIQ.EXE 740 dc.exe 740 dc.exe 3308 Fun.exe 3308 Fun.exe 2692 SVIQ.EXE 2692 SVIQ.EXE 740 dc.exe 740 dc.exe 3308 Fun.exe 3308 Fun.exe 2692 SVIQ.EXE 2692 SVIQ.EXE 740 dc.exe 740 dc.exe 3308 Fun.exe 3308 Fun.exe 2692 SVIQ.EXE 2692 SVIQ.EXE 740 dc.exe 740 dc.exe 3308 Fun.exe 3308 Fun.exe 2692 SVIQ.EXE 2692 SVIQ.EXE 740 dc.exe 740 dc.exe 3308 Fun.exe 3308 Fun.exe 2692 SVIQ.EXE 2692 SVIQ.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 3308 Fun.exe 3308 Fun.exe 2692 SVIQ.EXE 2692 SVIQ.EXE 740 dc.exe 740 dc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 216 wrote to memory of 3308 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 85 PID 216 wrote to memory of 3308 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 85 PID 216 wrote to memory of 3308 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 85 PID 3308 wrote to memory of 2692 3308 Fun.exe 86 PID 3308 wrote to memory of 2692 3308 Fun.exe 86 PID 3308 wrote to memory of 2692 3308 Fun.exe 86 PID 216 wrote to memory of 740 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 87 PID 216 wrote to memory of 740 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 87 PID 216 wrote to memory of 740 216 05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05fbc3e2f44bd89cf12279a1d04d8724_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\system\Fun.exeC:\Windows\system\Fun.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SVIQ.EXEC:\Windows\SVIQ.EXE3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2692
-
-
-
C:\Windows\dc.exeC:\Windows\dc.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD505fbc3e2f44bd89cf12279a1d04d8724
SHA127959ca5cf68c1efa4c4199c44de19921af78bcf
SHA256d32853505240162bed12d8cf9f5981eb786c40d32b6456efd304dae503c390bf
SHA5123662dd6747a4eec0c4b8b886a3b01875dce0390de5a5e08a1d95bf76665d62b51465653ab5327ff2ad22d5025e367bcc32a654248f2ffccc837a195c1a42e423
-
Filesize
41B
MD5e839977c0d22c9aa497b0b1d90d8a372
SHA1b5048e501399138796b38f3d3666e1a88c397e83
SHA256478db7f82fd7ef4860f7acd2f534ec303175500d7f4e1e36161d31c900d234e2
SHA5124c8ba5a26b6f738f8d25c32d019cee63e9a32d28e3aeb8fe31b965d7603c24a3539e469c8eb569747b47dadc9c43cdd1066ddb37ed8138bee5d0c74b5d0c275d