Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 16:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe
-
Size
72KB
-
MD5
07c63a054037d6f0383b21b43487a09e
-
SHA1
01501db29b80092ea5d3165ac928a49c2199bb08
-
SHA256
0bc719f42b7f20a351a4881c6981ebbfec91a5bff0d2b2f457b0c6e39c48fe79
-
SHA512
689784d9af774b1e6335c6935e2bd86065a07fd0c685a1091a924563e67e78766e33b9c97e3f0d07f4edd5f0ac6b09d14ae6165cc7df2cdb0f4411b51e793d79
-
SSDEEP
768:tkXmpLqANGFs6zUvnKy3HEynH0hrA5dWpDKrsJWb2BVCSvDWR0IEku:tkXWG8dH3LHU+8WrsMb2BNDWKIE/
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1192 LSASS.EXE 2632 SERVICES.EXE -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\AUTORUN.INF SERVICES.EXE File opened for modification C:\AUTORUN.INF SERVICES.EXE File created F:\AUTORUN.INF SERVICES.EXE File opened for modification F:\AUTORUN.INF SERVICES.EXE -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dllcache\explorer.exe794501900672913 LSASS.EXE -
Drops file in Program Files directory 10 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\LSASS.EXE88543117046356.2 07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\LSASS.EXE 07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\SERVICES.EXE LSASS.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\SERVICES.EXE LSASS.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\explorer.exe SERVICES.EXE File created C:\Program Files (x86)\Internet Explorer\LSASS.EXE 07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\explorer.exe LSASS.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\SERVICES.EXE438213527202606 LSASS.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\explorer.exe138347804546356 SERVICES.EXE File created C:\Program Files (x86)\Internet Explorer\explorer.exe SERVICES.EXE -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\explorer.exe526686608791351 SERVICES.EXE File opened for modification C:\Windows\explorer.exe948315560817719 SERVICES.EXE File opened for modification C:\Windows\explorer.exe924760580062866 SERVICES.EXE File opened for modification C:\Windows\explorer.exe384283542633057 SERVICES.EXE File opened for modification C:\Windows\explorer.exe925540626049042 SERVICES.EXE File opened for modification C:\Windows\explorer.exe302165985107422 SERVICES.EXE File opened for modification C:\Windows\explorer.exe475962638854981 SERVICES.EXE File opened for modification C:\Windows\explorer.exe227091133594513 SERVICES.EXE File opened for modification C:\Windows\explorer.exe225529849529266 SERVICES.EXE File opened for modification C:\Windows\explorer.exe752763688564301 SERVICES.EXE File opened for modification C:\Windows\explorer.exe367699384689331 SERVICES.EXE File opened for modification C:\Windows\explorer.exe925259053707123 SERVICES.EXE File opened for modification C:\Windows\explorer.exe53591132164001.5 SERVICES.EXE File opened for modification C:\Windows\explorer.exe855480670928955 SERVICES.EXE File opened for modification C:\Windows\explorer.exe245949208736420 SERVICES.EXE File opened for modification C:\Windows\explorer.exe617828905582428 SERVICES.EXE File opened for modification C:\Windows\explorer.exe879582047462463 SERVICES.EXE File opened for modification C:\Windows\explorer.exe321380317211151 SERVICES.EXE File opened for modification C:\Windows\explorer.exe849927783012390 SERVICES.EXE File opened for modification C:\Windows\explorer.exe543379485607147 SERVICES.EXE File opened for modification C:\Windows\explorer.exe798533976078034 SERVICES.EXE File opened for modification C:\Windows\explorer.exe539922118186951 SERVICES.EXE File opened for modification C:\Windows\explorer.exe728837788105011 SERVICES.EXE File opened for modification C:\Windows\explorer.exe364448189735413 SERVICES.EXE File opened for modification C:\Windows\explorer.exe983637690544128 SERVICES.EXE File opened for modification C:\Windows\explorer.exe651444137096405 SERVICES.EXE File opened for modification C:\Windows\explorer.exe543559670448303 SERVICES.EXE File opened for modification C:\Windows\explorer.exe985731482505798 SERVICES.EXE File opened for modification C:\Windows\explorer.exe669461071491242 SERVICES.EXE File opened for modification C:\Windows\explorer.exe606040537357330 SERVICES.EXE File opened for modification C:\Windows\explorer.exe62895357608795.2 SERVICES.EXE File opened for modification C:\Windows\explorer.exe403282165527344 SERVICES.EXE File opened for modification C:\Windows\explorer.exe165184855461121 SERVICES.EXE File opened for modification C:\Windows\explorer.exe957659423351288 SERVICES.EXE File opened for modification C:\Windows\explorer.exe737696468830109 SERVICES.EXE File opened for modification C:\Windows\explorer.exe278742849826813 SERVICES.EXE File opened for modification C:\Windows\explorer.exe317957520484924 SERVICES.EXE File opened for modification C:\Windows\explorer.exe888435721397400 SERVICES.EXE File opened for modification C:\Windows\explorer.exe676759719848633 SERVICES.EXE File opened for modification C:\Windows\explorer.exe789138019084930 SERVICES.EXE File opened for modification C:\Windows\explorer.exe30529558658599.9 SERVICES.EXE File opened for modification C:\Windows\explorer.exe13800323009491 SERVICES.EXE File opened for modification C:\Windows\explorer.exe544597089290619 SERVICES.EXE File opened for modification C:\Windows\explorer.exe862458705902100 SERVICES.EXE File opened for modification C:\Windows\explorer.exe197288274765015 SERVICES.EXE File opened for modification C:\Windows\explorer.exe605440616607666 SERVICES.EXE File opened for modification C:\Windows\explorer.exe213654160499573 SERVICES.EXE File opened for modification C:\Windows\explorer.exe703306436538696 SERVICES.EXE File opened for modification C:\Windows\explorer.exe611652910709381 SERVICES.EXE File opened for modification C:\Windows\explorer.exe857613682746887 SERVICES.EXE File opened for modification C:\Windows\explorer.exe509169876575470 SERVICES.EXE File opened for modification C:\Windows\explorer.exe123261809349060 SERVICES.EXE File opened for modification C:\Windows\explorer.exe581468641757965 SERVICES.EXE File opened for modification C:\Windows\explorer.exe349487423896790 SERVICES.EXE File opened for modification C:\Windows\explorer.exe711075782775879 SERVICES.EXE File opened for modification C:\Windows\explorer.exe287868380546570 SERVICES.EXE File opened for modification C:\Windows\explorer.exe776881694793701 SERVICES.EXE File opened for modification C:\Windows\explorer.exe57516157627105.7 SERVICES.EXE File opened for modification C:\Windows\explorer.exe303737580776215 SERVICES.EXE File opened for modification C:\Windows\explorer.exe770477533340454 SERVICES.EXE File opened for modification C:\Windows\explorer.exe663576662540436 SERVICES.EXE File opened for modification C:\Windows\explorer.exe811128497123718 SERVICES.EXE File opened for modification C:\Windows\explorer.exe242101490497589 SERVICES.EXE File opened for modification C:\Windows\explorer.exe986320018768311 SERVICES.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 53 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt1\shell\open\command LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt1\shell\open\command\ = "C:\\Program Files (x86)\\Internet Explorer\\SERVICES.EXE %1" LSASS.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.gif LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.jpe\ = "PbWzdmngmt3" SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt1\shell\open\command SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt1\DefaultIcon SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt2\shell\open\command SERVICES.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.jpeg LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt1\shell\open LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.bmp\ = "PbWzdmngmt1" SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt1\shell LSASS.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.jpeg SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt2\DefaultIcon SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt1\DefaultIcon LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt2\shell\open LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt3\shell LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.gif\ = "PbWzdmngmt2" LSASS.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.jpg SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt3\DefaultIcon LSASS.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.jpg LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt2\shell LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt1\shell\open\command\ = "C:\\Program Files (x86)\\Internet Explorer\\SERVICES.EXE %1" SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt2\DefaultIcon\ = "shimgvw.dll,2" SERVICES.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.gif SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt3\shell\open\command\ = "C:\\Program Files (x86)\\Internet Explorer\\SERVICES.EXE %1" LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt3\shell\open LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt3\DefaultIcon\ = "shimgvw.dll,3" LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.jpe\ = "PbWzdmngmt3" LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt1 LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt3\shell\open\command\ = "C:\\Program Files (x86)\\Internet Explorer\\SERVICES.EXE %1" SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt3 LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt3\DefaultIcon SERVICES.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.jpe SERVICES.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.bmp LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt3\DefaultIcon\ = "shimgvw.dll,3" SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt1\DefaultIcon\ = "shimgvw.dll,1" SERVICES.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.gif\ = "PbWzdmngmt2" SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt3\shell\open\command SERVICES.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.bmp SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt2\shell\open\command\ = "C:\\Program Files (x86)\\Internet Explorer\\SERVICES.EXE %1" LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt2 LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.jpeg\ = "PbWzdmngmt3" SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt2\shell\open\command\ = "C:\\Program Files (x86)\\Internet Explorer\\SERVICES.EXE %1" SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt1\DefaultIcon\ = "shimgvw.dll,1" LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.jpeg\ = "PbWzdmngmt3" LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.jpg\ = "PbWzdmngmt3" LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt2\shell\open\command LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt2\DefaultIcon LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.jpg\ = "PbWzdmngmt3" SERVICES.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.jpe LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.bmp\ = "PbWzdmngmt1" LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt2\DefaultIcon\ = "shimgvw.dll,2" LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PbWzdmngmt3\shell\open\command LSASS.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1004 07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe 1004 07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe 1192 LSASS.EXE 1192 LSASS.EXE 1192 LSASS.EXE 1192 LSASS.EXE 2632 SERVICES.EXE 2632 SERVICES.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1004 07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe 1192 LSASS.EXE 2632 SERVICES.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1004 wrote to memory of 1192 1004 07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe 82 PID 1004 wrote to memory of 1192 1004 07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe 82 PID 1004 wrote to memory of 1192 1004 07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe 82 PID 1192 wrote to memory of 2632 1192 LSASS.EXE 87 PID 1192 wrote to memory of 2632 1192 LSASS.EXE 87 PID 1192 wrote to memory of 2632 1192 LSASS.EXE 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\07c63a054037d6f0383b21b43487a09e_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Program Files (x86)\Internet Explorer\LSASS.EXE"C:\Program Files (x86)\Internet Explorer\LSASS.EXE"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Program Files (x86)\Internet Explorer\SERVICES.EXE"C:\Program Files (x86)\Internet Explorer\SERVICES.EXE"3⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2632
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126B
MD5e6e4ebed1c7610a841d80ed42f5c1d9c
SHA1ba1143c21aa4589048afc8e036e72c68b08c87db
SHA25667f1fd83f1623b9d080ddbfdce3229e4f523826cc2046cd3f12fa4daddad6e43
SHA5122de8af6cf45b28af90d7a9b479f234c7ff7eca4c0f67d2ea9c4d2a41fab2f05dd375faba227e69fa1633b4a7f0904531fd94573d4b147fa567be06d01dbc7c71
-
Filesize
72KB
MD507c63a054037d6f0383b21b43487a09e
SHA101501db29b80092ea5d3165ac928a49c2199bb08
SHA2560bc719f42b7f20a351a4881c6981ebbfec91a5bff0d2b2f457b0c6e39c48fe79
SHA512689784d9af774b1e6335c6935e2bd86065a07fd0c685a1091a924563e67e78766e33b9c97e3f0d07f4edd5f0ac6b09d14ae6165cc7df2cdb0f4411b51e793d79