Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 19:14
Static task
static1
Behavioral task
behavioral1
Sample
131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
-
Size
787KB
-
MD5
131da82ef6d07117f53b510d30868284
-
SHA1
369931664189b626bd77b3af71b2c808effb8b0a
-
SHA256
99156da53e622418cbd84c7de2dd8dc49d9068bc8cb227b1ba7f6d47667d1e09
-
SHA512
d959b283a2f077e50a66d019e13a600c3ed6b5f927fbd84d8db8542109c1aa0f22957ae4d3be934cac6448b0a14dee6129a64937e049a732ec8afd7634562999
-
SSDEEP
12288:1ERH1F+Wig3LxzA2AijRTTpXsLioEwN7vblTs13Q0oK2KmO5VMzXuD43lpUD7y:uRH6WZdVAqfsLiGN7bGdadOmmqlO/y
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\GoogleUpdater\\GoogleUpdater.exe" 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
GoogleUpdater.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" GoogleUpdater.exe -
Processes:
GoogleUpdater.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" GoogleUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" GoogleUpdater.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exeGoogleUpdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate GoogleUpdater.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
GoogleUpdater.exeGoogleUpdater.exepid process 556 GoogleUpdater.exe 1828 GoogleUpdater.exe -
Processes:
GoogleUpdater.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" GoogleUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" GoogleUpdater.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleUpdater\\GoogleUpdater.exe" 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exeGoogleUpdater.exedescription pid process target process PID 2748 set thread context of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 556 set thread context of 1828 556 GoogleUpdater.exe GoogleUpdater.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exeGoogleUpdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoogleUpdater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoogleUpdater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier GoogleUpdater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier GoogleUpdater.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exeGoogleUpdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier GoogleUpdater.exe -
Modifies registry class 1 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
GoogleUpdater.exepid process 1828 GoogleUpdater.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exeGoogleUpdater.exedescription pid process Token: SeIncreaseQuotaPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeSecurityPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeSystemtimePrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeBackupPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeRestorePrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeShutdownPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeDebugPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeUndockPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeManageVolumePrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeImpersonatePrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: 33 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: 34 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: 35 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: 36 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 1828 GoogleUpdater.exe Token: SeSecurityPrivilege 1828 GoogleUpdater.exe Token: SeTakeOwnershipPrivilege 1828 GoogleUpdater.exe Token: SeLoadDriverPrivilege 1828 GoogleUpdater.exe Token: SeSystemProfilePrivilege 1828 GoogleUpdater.exe Token: SeSystemtimePrivilege 1828 GoogleUpdater.exe Token: SeProfSingleProcessPrivilege 1828 GoogleUpdater.exe Token: SeIncBasePriorityPrivilege 1828 GoogleUpdater.exe Token: SeCreatePagefilePrivilege 1828 GoogleUpdater.exe Token: SeBackupPrivilege 1828 GoogleUpdater.exe Token: SeRestorePrivilege 1828 GoogleUpdater.exe Token: SeShutdownPrivilege 1828 GoogleUpdater.exe Token: SeDebugPrivilege 1828 GoogleUpdater.exe Token: SeSystemEnvironmentPrivilege 1828 GoogleUpdater.exe Token: SeChangeNotifyPrivilege 1828 GoogleUpdater.exe Token: SeRemoteShutdownPrivilege 1828 GoogleUpdater.exe Token: SeUndockPrivilege 1828 GoogleUpdater.exe Token: SeManageVolumePrivilege 1828 GoogleUpdater.exe Token: SeImpersonatePrivilege 1828 GoogleUpdater.exe Token: SeCreateGlobalPrivilege 1828 GoogleUpdater.exe Token: 33 1828 GoogleUpdater.exe Token: 34 1828 GoogleUpdater.exe Token: 35 1828 GoogleUpdater.exe Token: 36 1828 GoogleUpdater.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
GoogleUpdater.exepid process 1828 GoogleUpdater.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
131da82ef6d07117f53b510d30868284_JaffaCakes118.exe131da82ef6d07117f53b510d30868284_JaffaCakes118.exeGoogleUpdater.execmd.exedescription pid process target process PID 2748 wrote to memory of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2748 wrote to memory of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2748 wrote to memory of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2748 wrote to memory of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2748 wrote to memory of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2748 wrote to memory of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2748 wrote to memory of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2748 wrote to memory of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2748 wrote to memory of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2748 wrote to memory of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2748 wrote to memory of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2748 wrote to memory of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 2748 wrote to memory of 4016 2748 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe PID 4016 wrote to memory of 556 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe GoogleUpdater.exe PID 4016 wrote to memory of 556 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe GoogleUpdater.exe PID 4016 wrote to memory of 556 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe GoogleUpdater.exe PID 4016 wrote to memory of 2628 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe cmd.exe PID 4016 wrote to memory of 2628 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe cmd.exe PID 4016 wrote to memory of 2628 4016 131da82ef6d07117f53b510d30868284_JaffaCakes118.exe cmd.exe PID 556 wrote to memory of 1828 556 GoogleUpdater.exe GoogleUpdater.exe PID 556 wrote to memory of 1828 556 GoogleUpdater.exe GoogleUpdater.exe PID 556 wrote to memory of 1828 556 GoogleUpdater.exe GoogleUpdater.exe PID 556 wrote to memory of 1828 556 GoogleUpdater.exe GoogleUpdater.exe PID 556 wrote to memory of 1828 556 GoogleUpdater.exe GoogleUpdater.exe PID 556 wrote to memory of 1828 556 GoogleUpdater.exe GoogleUpdater.exe PID 556 wrote to memory of 1828 556 GoogleUpdater.exe GoogleUpdater.exe PID 556 wrote to memory of 1828 556 GoogleUpdater.exe GoogleUpdater.exe PID 556 wrote to memory of 1828 556 GoogleUpdater.exe GoogleUpdater.exe PID 556 wrote to memory of 1828 556 GoogleUpdater.exe GoogleUpdater.exe PID 556 wrote to memory of 1828 556 GoogleUpdater.exe GoogleUpdater.exe PID 556 wrote to memory of 1828 556 GoogleUpdater.exe GoogleUpdater.exe PID 556 wrote to memory of 1828 556 GoogleUpdater.exe GoogleUpdater.exe PID 2628 wrote to memory of 1504 2628 cmd.exe PING.EXE PID 2628 wrote to memory of 1504 2628 cmd.exe PING.EXE PID 2628 wrote to memory of 1504 2628 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe"C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exeC:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe4⤵
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 24⤵
- Runs ping.exe
PID:1504
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:4300
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119B
MD5edb2ec773e95951ab9a67bbf9ddca873
SHA10a01b0e8687717ff2694c6a9509ad00db7c7c066
SHA256c9d727ed176425740dee2ea0a05f02795011dbe291ed87f0861f318c1b54b9e0
SHA5120702519f37522e0666ba754baabaf2015ccdbb65b335d7d5a1a6e3d98bf927916c6e818bf63efbd5b7ac0116d0b255f1e8f95671c9c55519ff8813d69d58f052
-
Filesize
787KB
MD5131da82ef6d07117f53b510d30868284
SHA1369931664189b626bd77b3af71b2c808effb8b0a
SHA25699156da53e622418cbd84c7de2dd8dc49d9068bc8cb227b1ba7f6d47667d1e09
SHA512d959b283a2f077e50a66d019e13a600c3ed6b5f927fbd84d8db8542109c1aa0f22957ae4d3be934cac6448b0a14dee6129a64937e049a732ec8afd7634562999