Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-06-2024 19:14
Static task
static1
Behavioral task
behavioral1
Sample
131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
-
Size
787KB
-
MD5
131da82ef6d07117f53b510d30868284
-
SHA1
369931664189b626bd77b3af71b2c808effb8b0a
-
SHA256
99156da53e622418cbd84c7de2dd8dc49d9068bc8cb227b1ba7f6d47667d1e09
-
SHA512
d959b283a2f077e50a66d019e13a600c3ed6b5f927fbd84d8db8542109c1aa0f22957ae4d3be934cac6448b0a14dee6129a64937e049a732ec8afd7634562999
-
SSDEEP
12288:1ERH1F+Wig3LxzA2AijRTTpXsLioEwN7vblTs13Q0oK2KmO5VMzXuD43lpUD7y:uRH6WZdVAqfsLiGN7bGdadOmmqlO/y
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\GoogleUpdater\\GoogleUpdater.exe" 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
GoogleUpdater.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" GoogleUpdater.exe -
Processes:
GoogleUpdater.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" GoogleUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" GoogleUpdater.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
GoogleUpdater.exe131da82ef6d07117f53b510d30868284_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate GoogleUpdater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2548 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
GoogleUpdater.exeGoogleUpdater.exepid process 2568 GoogleUpdater.exe 2788 GoogleUpdater.exe -
Loads dropped DLL 8 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exeGoogleUpdater.exeGoogleUpdater.exepid process 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 2568 GoogleUpdater.exe 2568 GoogleUpdater.exe 2568 GoogleUpdater.exe 2568 GoogleUpdater.exe 2788 GoogleUpdater.exe 2788 GoogleUpdater.exe 2788 GoogleUpdater.exe -
Processes:
GoogleUpdater.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" GoogleUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" GoogleUpdater.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleUpdater\\GoogleUpdater.exe" 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exeGoogleUpdater.exedescription pid process target process PID 2196 set thread context of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2568 set thread context of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
GoogleUpdater.exe131da82ef6d07117f53b510d30868284_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier GoogleUpdater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier GoogleUpdater.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoogleUpdater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoogleUpdater.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exeGoogleUpdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier GoogleUpdater.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
GoogleUpdater.exepid process 2788 GoogleUpdater.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exeGoogleUpdater.exedescription pid process Token: SeIncreaseQuotaPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeSecurityPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeSystemtimePrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeBackupPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeRestorePrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeShutdownPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeDebugPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeUndockPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeManageVolumePrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeImpersonatePrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: 33 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: 34 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: 35 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2788 GoogleUpdater.exe Token: SeSecurityPrivilege 2788 GoogleUpdater.exe Token: SeTakeOwnershipPrivilege 2788 GoogleUpdater.exe Token: SeLoadDriverPrivilege 2788 GoogleUpdater.exe Token: SeSystemProfilePrivilege 2788 GoogleUpdater.exe Token: SeSystemtimePrivilege 2788 GoogleUpdater.exe Token: SeProfSingleProcessPrivilege 2788 GoogleUpdater.exe Token: SeIncBasePriorityPrivilege 2788 GoogleUpdater.exe Token: SeCreatePagefilePrivilege 2788 GoogleUpdater.exe Token: SeBackupPrivilege 2788 GoogleUpdater.exe Token: SeRestorePrivilege 2788 GoogleUpdater.exe Token: SeShutdownPrivilege 2788 GoogleUpdater.exe Token: SeDebugPrivilege 2788 GoogleUpdater.exe Token: SeSystemEnvironmentPrivilege 2788 GoogleUpdater.exe Token: SeChangeNotifyPrivilege 2788 GoogleUpdater.exe Token: SeRemoteShutdownPrivilege 2788 GoogleUpdater.exe Token: SeUndockPrivilege 2788 GoogleUpdater.exe Token: SeManageVolumePrivilege 2788 GoogleUpdater.exe Token: SeImpersonatePrivilege 2788 GoogleUpdater.exe Token: SeCreateGlobalPrivilege 2788 GoogleUpdater.exe Token: 33 2788 GoogleUpdater.exe Token: 34 2788 GoogleUpdater.exe Token: 35 2788 GoogleUpdater.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
GoogleUpdater.exepid process 2788 GoogleUpdater.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exe131da82ef6d07117f53b510d30868284_JaffaCakes118.execmd.exeGoogleUpdater.exedescription pid process target process PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2196 wrote to memory of 2068 2196 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2068 wrote to memory of 2568 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe GoogleUpdater.exe PID 2068 wrote to memory of 2568 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe GoogleUpdater.exe PID 2068 wrote to memory of 2568 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe GoogleUpdater.exe PID 2068 wrote to memory of 2568 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe GoogleUpdater.exe PID 2068 wrote to memory of 2568 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe GoogleUpdater.exe PID 2068 wrote to memory of 2568 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe GoogleUpdater.exe PID 2068 wrote to memory of 2568 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe GoogleUpdater.exe PID 2068 wrote to memory of 2548 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe cmd.exe PID 2068 wrote to memory of 2548 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe cmd.exe PID 2068 wrote to memory of 2548 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe cmd.exe PID 2068 wrote to memory of 2548 2068 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe cmd.exe PID 2548 wrote to memory of 2556 2548 cmd.exe PING.EXE PID 2548 wrote to memory of 2556 2548 cmd.exe PING.EXE PID 2548 wrote to memory of 2556 2548 cmd.exe PING.EXE PID 2548 wrote to memory of 2556 2548 cmd.exe PING.EXE PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe PID 2568 wrote to memory of 2788 2568 GoogleUpdater.exe GoogleUpdater.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe"C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exeC:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe4⤵
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2788 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 24⤵
- Runs ping.exe
PID:2556
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119B
MD5edb2ec773e95951ab9a67bbf9ddca873
SHA10a01b0e8687717ff2694c6a9509ad00db7c7c066
SHA256c9d727ed176425740dee2ea0a05f02795011dbe291ed87f0861f318c1b54b9e0
SHA5120702519f37522e0666ba754baabaf2015ccdbb65b335d7d5a1a6e3d98bf927916c6e818bf63efbd5b7ac0116d0b255f1e8f95671c9c55519ff8813d69d58f052
-
Filesize
787KB
MD5131da82ef6d07117f53b510d30868284
SHA1369931664189b626bd77b3af71b2c808effb8b0a
SHA25699156da53e622418cbd84c7de2dd8dc49d9068bc8cb227b1ba7f6d47667d1e09
SHA512d959b283a2f077e50a66d019e13a600c3ed6b5f927fbd84d8db8542109c1aa0f22957ae4d3be934cac6448b0a14dee6129a64937e049a732ec8afd7634562999