Analysis
- max time kernel
139s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
24/06/2024, 20:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe
- Size 1.2MB
- Sample240624-yxeqaatfll
- SHA256 cdcff9a0de10298d22198b2e2db9a7d7dd663b0f38399e681502c14a2edc5996
- MD5 0a9c01708e0205a8d4cdb37033a7cc3d
- SHA1 2f8cf0a08666c00fc8f297cc600a7f6ad6bb996f
- SHA512 8fe179e1e921a4db269e9c85dec79ca85d0ee2f041dadfaff7e7bb4c8f0db74f725df5ea7da7c80be4294cb5026f77da7d3ff54629570d121e49720b9decb079
- SSDEEP 24576:cWwQMN2K3yWds0JkKyVANF6kPx9wR/dgkCg6QWwkKAnrI6P/iSLy1DzK:cWlhadsLGfD3ad+gcwIJbyI
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\WindowsUpdate\\winupdate.exe" 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe - Executes dropped EXE 2 IoCs
pid Process 1484 winupdate.exe 2200 winupdate.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\WindowsUpdate\\winupdate.exe" 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 1484 winupdate.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4028 set thread context of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 1484 set thread context of 2200 1484 winupdate.exe 95 - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\WindowsUpdate\winupdate.exe 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe File opened for modification C:\Windows\WindowsUpdate\winupdate.exe 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe File opened for modification C:\Windows\WindowsUpdate\ 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe File opened for modification C:\Windows\WindowsUpdate\winupdate.exe winupdate.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
pid pid_target Process procid_target 4076 2200 WerFault.exe 95 2780 2200 WerFault.exe 95 - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2200 winupdate.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeSecurityPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeSystemtimePrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeBackupPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeRestorePrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeShutdownPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeDebugPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeUndockPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeManageVolumePrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeImpersonatePrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: 33 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: 34 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: 35 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: 36 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2200 winupdate.exe Token: SeSecurityPrivilege 2200 winupdate.exe Token: SeTakeOwnershipPrivilege 2200 winupdate.exe Token: SeLoadDriverPrivilege 2200 winupdate.exe Token: SeSystemProfilePrivilege 2200 winupdate.exe Token: SeSystemtimePrivilege 2200 winupdate.exe Token: SeProfSingleProcessPrivilege 2200 winupdate.exe Token: SeIncBasePriorityPrivilege 2200 winupdate.exe Token: SeCreatePagefilePrivilege 2200 winupdate.exe Token: SeBackupPrivilege 2200 winupdate.exe Token: SeRestorePrivilege 2200 winupdate.exe Token: SeShutdownPrivilege 2200 winupdate.exe Token: SeDebugPrivilege 2200 winupdate.exe Token: SeSystemEnvironmentPrivilege 2200 winupdate.exe Token: SeChangeNotifyPrivilege 2200 winupdate.exe Token: SeRemoteShutdownPrivilege 2200 winupdate.exe Token: SeUndockPrivilege 2200 winupdate.exe Token: SeManageVolumePrivilege 2200 winupdate.exe Token: SeImpersonatePrivilege 2200 winupdate.exe Token: SeCreateGlobalPrivilege 2200 winupdate.exe Token: 33 2200 winupdate.exe Token: 34 2200 winupdate.exe Token: 35 2200 winupdate.exe Token: 36 2200 winupdate.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 1484 winupdate.exe 1484 winupdate.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 4028 wrote to memory of 2104 4028 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 90 PID 2104 wrote to memory of 4592 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 91 PID 2104 wrote to memory of 4592 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 91 PID 2104 wrote to memory of 4592 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 91 PID 2104 wrote to memory of 1484 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 92 PID 2104 wrote to memory of 1484 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 92 PID 2104 wrote to memory of 1484 2104 0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe 92 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 1484 wrote to memory of 2200 1484 winupdate.exe 95 PID 2200 wrote to memory of 1952 2200 winupdate.exe 96 PID 2200 wrote to memory of 1952 2200 winupdate.exe 96 PID 2200 wrote to memory of 1952 2200 winupdate.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0a9c01708e0205a8d4cdb37033a7cc3d_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵PID:4592
-
-
C:\Windows\WindowsUpdate\winupdate.exe"C:\Windows\WindowsUpdate\winupdate.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\WindowsUpdate\winupdate.exeC:\Windows\WindowsUpdate\winupdate.exe4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"5⤵PID:1952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 8405⤵
- Program crash
PID:4076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 10125⤵
- Program crash
PID:2780
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2200 -ip 22001⤵PID:1124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2200 -ip 22001⤵PID:3444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\WindowsUpdate\winupdate.exe
- Size 1.2MB
- SHA256 cdcff9a0de10298d22198b2e2db9a7d7dd663b0f38399e681502c14a2edc5996
- MD5 0a9c01708e0205a8d4cdb37033a7cc3d
- SHA1 2f8cf0a08666c00fc8f297cc600a7f6ad6bb996f
- SHA512 8fe179e1e921a4db269e9c85dec79ca85d0ee2f041dadfaff7e7bb4c8f0db74f725df5ea7da7c80be4294cb5026f77da7d3ff54629570d121e49720b9decb079
- SSDEEP 24576:cWwQMN2K3yWds0JkKyVANF6kPx9wR/dgkCg6QWwkKAnrI6P/iSLy1DzK:cWlhadsLGfD3ad+gcwIJbyI
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\users\admin\appdata\local\temp\289B9A8F
- Size 14B
- SHA256 854fb9299748d3ca17bc8c1f3f7ae174a2949476b9c1d8b79298ffa3fefa88dd
- MD5 42ff5e8572dabeea0f14a769ec525cfa
- SHA1 5bdf826109e5cbc53722ce15a7d1e8e609ca7c11
- SHA512 8210fbec1acf89e28da37d5d79994bf631a9eef68f1849b7e0f4abee1ee23c0d10cbbf33f0af0d98548a7db1b56fa6ebf08649275cc7372e8a5b46293c7ffa4e
- MD5 SHA1 SHA512