Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
26/06/2024, 11:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11cb4eb10453d144006a6f84d2a3048b_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
11cb4eb10453d144006a6f84d2a3048b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 11cb4eb10453d144006a6f84d2a3048b_JaffaCakes118.exe
- Size 1.3MB
- Sample240626-m88a7asala
- SHA256 d901e7642ce6df81c42f02571068de58a2955e5c299be950c0746f868a9399ec
- MD5 11cb4eb10453d144006a6f84d2a3048b
- SHA1 7967a0d2b34c4b86be783b8ce3b4c51691fafba3
- SHA512 03c33268b60eb9bf6b96acfafd64ef5ef5cca2e99ab05c31d93779afcb5ba9c88ce7b952f6a06f8127216b29ba275ec954fb126087ca63723a93f0abd0dc1572
- SSDEEP 24576:BbCrhfsSO6omIC13GWK5m0c4RWj0KmSFe6In4uBCqGCLSrWbk:Bb0hkS2bCFSwgRWj0s2oqpZk
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Update\\winupdate.exe" Service.exe - Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" explorer.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Service.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 11cb4eb10453d144006a6f84d2a3048b_JaffaCakes118.exe - Executes dropped EXE 1 IoCs
pid Process 4384 Service.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Update\\winupdate.exe" Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Update\\winupdate.exe" notepad.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Update\winupdate.exe Service.exe File opened for modification C:\Windows\SysWOW64\Update\winupdate.exe notepad.exe File opened for modification C:\Windows\SysWOW64\Update\ Service.exe File created C:\Windows\SysWOW64\Update\winupdate.exe Service.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4384 set thread context of 3368 4384 Service.exe 92 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Service.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Service.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Service.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Service.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Service.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4384 Service.exe Token: SeSecurityPrivilege 4384 Service.exe Token: SeTakeOwnershipPrivilege 4384 Service.exe Token: SeLoadDriverPrivilege 4384 Service.exe Token: SeSystemProfilePrivilege 4384 Service.exe Token: SeSystemtimePrivilege 4384 Service.exe Token: SeProfSingleProcessPrivilege 4384 Service.exe Token: SeIncBasePriorityPrivilege 4384 Service.exe Token: SeCreatePagefilePrivilege 4384 Service.exe Token: SeBackupPrivilege 4384 Service.exe Token: SeRestorePrivilege 4384 Service.exe Token: SeShutdownPrivilege 4384 Service.exe Token: SeDebugPrivilege 4384 Service.exe Token: SeSystemEnvironmentPrivilege 4384 Service.exe Token: SeChangeNotifyPrivilege 4384 Service.exe Token: SeRemoteShutdownPrivilege 4384 Service.exe Token: SeUndockPrivilege 4384 Service.exe Token: SeManageVolumePrivilege 4384 Service.exe Token: SeImpersonatePrivilege 4384 Service.exe Token: SeCreateGlobalPrivilege 4384 Service.exe Token: 33 4384 Service.exe Token: 34 4384 Service.exe Token: 35 4384 Service.exe Token: 36 4384 Service.exe Token: SeIncreaseQuotaPrivilege 3368 explorer.exe Token: SeSecurityPrivilege 3368 explorer.exe Token: SeTakeOwnershipPrivilege 3368 explorer.exe Token: SeLoadDriverPrivilege 3368 explorer.exe Token: SeSystemProfilePrivilege 3368 explorer.exe Token: SeSystemtimePrivilege 3368 explorer.exe Token: SeProfSingleProcessPrivilege 3368 explorer.exe Token: SeIncBasePriorityPrivilege 3368 explorer.exe Token: SeCreatePagefilePrivilege 3368 explorer.exe Token: SeBackupPrivilege 3368 explorer.exe Token: SeRestorePrivilege 3368 explorer.exe Token: SeShutdownPrivilege 3368 explorer.exe Token: SeDebugPrivilege 3368 explorer.exe Token: SeSystemEnvironmentPrivilege 3368 explorer.exe Token: SeChangeNotifyPrivilege 3368 explorer.exe Token: SeRemoteShutdownPrivilege 3368 explorer.exe Token: SeUndockPrivilege 3368 explorer.exe Token: SeManageVolumePrivilege 3368 explorer.exe Token: SeImpersonatePrivilege 3368 explorer.exe Token: SeCreateGlobalPrivilege 3368 explorer.exe Token: 33 3368 explorer.exe Token: 34 3368 explorer.exe Token: 35 3368 explorer.exe Token: 36 3368 explorer.exe - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 2752 wrote to memory of 4384 2752 11cb4eb10453d144006a6f84d2a3048b_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4384 2752 11cb4eb10453d144006a6f84d2a3048b_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4384 2752 11cb4eb10453d144006a6f84d2a3048b_JaffaCakes118.exe 84 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 4880 4384 Service.exe 85 PID 4384 wrote to memory of 3368 4384 Service.exe 92 PID 4384 wrote to memory of 3368 4384 Service.exe 92 PID 4384 wrote to memory of 3368 4384 Service.exe 92 PID 4384 wrote to memory of 3368 4384 Service.exe 92 PID 4384 wrote to memory of 3368 4384 Service.exe 92 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93 PID 3368 wrote to memory of 4944 3368 explorer.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\11cb4eb10453d144006a6f84d2a3048b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11cb4eb10453d144006a6f84d2a3048b_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\Service.exe"C:\Users\Admin\AppData\Local\Temp\Service.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4880
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe4⤵PID:4944
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Service.exe
- Size 691KB
- SHA256 a51af90af9a2b35cbf5b6baaeadfed634ac2ff3956586f5fa2e59936f75aeeb2
- MD5 081581fef9e34526d9c6eedc9cf694ba
- SHA1 02a8949097003d4998e1a2cfe71956ea913d5671
- SHA512 0384a11f4e80487ad5aa514b02423cfb278b54b2795be405a435ae056b43048b7bb3e3680ff23b1060a0050cc5b476a80f327d74661e0103f4935e3912bed9b3
- SSDEEP 12288:j9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnK:BAQ6Zx9cxTmOrucTIEFSpOG
- MD5 SHA1 SHA512 SSDEEP