Analysis
-
max time kernel
34s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 11:52
Static task
static1
Behavioral task
behavioral1
Sample
15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
15e79e75f052a82d3e1a2cd88028596f
-
SHA1
ec3f2e8e2fe31d232bd45d7d54c79dbe81c47994
-
SHA256
938bfda0209c6bb2e28e0094245a0ce708c75f19b42a557054d9a1efde1b1335
-
SHA512
8b425d73fb21de18b8fa549a2719cc22da45e0eccd45c1168ee2ffdfd26dd1db3090a0ebd1eb28608e7dad6d1f60de54246f232579c134e779d4a9114ff16ab3
-
SSDEEP
24576:1BjwYUcORkNuE9agxxs3HAfpnJ+xxxgQUSFKJnNiu/J5tL:qcuE9xxs3HAB8xTflFKJNx/VL
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ephir.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" ephir.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Executes dropped EXE 3 IoCs
Processes:
winlogon.exeephir.exewinupdate.exepid process 2976 winlogon.exe 2552 ephir.exe 1656 winupdate.exe -
Loads dropped DLL 7 IoCs
Processes:
15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exewinlogon.exeephir.exewinupdate.exepid process 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe 2976 winlogon.exe 2976 winlogon.exe 2552 ephir.exe 1656 winupdate.exe 1656 winupdate.exe 1656 winupdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ephir.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" ephir.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exedescription pid process target process PID 1992 set thread context of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exepid process 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exeephir.exewinupdate.exedescription pid process Token: SeDebugPrivilege 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2552 ephir.exe Token: SeSecurityPrivilege 2552 ephir.exe Token: SeTakeOwnershipPrivilege 2552 ephir.exe Token: SeLoadDriverPrivilege 2552 ephir.exe Token: SeSystemProfilePrivilege 2552 ephir.exe Token: SeSystemtimePrivilege 2552 ephir.exe Token: SeProfSingleProcessPrivilege 2552 ephir.exe Token: SeIncBasePriorityPrivilege 2552 ephir.exe Token: SeCreatePagefilePrivilege 2552 ephir.exe Token: SeBackupPrivilege 2552 ephir.exe Token: SeRestorePrivilege 2552 ephir.exe Token: SeShutdownPrivilege 2552 ephir.exe Token: SeDebugPrivilege 2552 ephir.exe Token: SeSystemEnvironmentPrivilege 2552 ephir.exe Token: SeChangeNotifyPrivilege 2552 ephir.exe Token: SeRemoteShutdownPrivilege 2552 ephir.exe Token: SeUndockPrivilege 2552 ephir.exe Token: SeManageVolumePrivilege 2552 ephir.exe Token: SeImpersonatePrivilege 2552 ephir.exe Token: SeCreateGlobalPrivilege 2552 ephir.exe Token: 33 2552 ephir.exe Token: 34 2552 ephir.exe Token: 35 2552 ephir.exe Token: SeIncreaseQuotaPrivilege 1656 winupdate.exe Token: SeSecurityPrivilege 1656 winupdate.exe Token: SeTakeOwnershipPrivilege 1656 winupdate.exe Token: SeLoadDriverPrivilege 1656 winupdate.exe Token: SeSystemProfilePrivilege 1656 winupdate.exe Token: SeSystemtimePrivilege 1656 winupdate.exe Token: SeProfSingleProcessPrivilege 1656 winupdate.exe Token: SeIncBasePriorityPrivilege 1656 winupdate.exe Token: SeCreatePagefilePrivilege 1656 winupdate.exe Token: SeBackupPrivilege 1656 winupdate.exe Token: SeRestorePrivilege 1656 winupdate.exe Token: SeShutdownPrivilege 1656 winupdate.exe Token: SeDebugPrivilege 1656 winupdate.exe Token: SeSystemEnvironmentPrivilege 1656 winupdate.exe Token: SeChangeNotifyPrivilege 1656 winupdate.exe Token: SeRemoteShutdownPrivilege 1656 winupdate.exe Token: SeUndockPrivilege 1656 winupdate.exe Token: SeManageVolumePrivilege 1656 winupdate.exe Token: SeImpersonatePrivilege 1656 winupdate.exe Token: SeCreateGlobalPrivilege 1656 winupdate.exe Token: 33 1656 winupdate.exe Token: 34 1656 winupdate.exe Token: 35 1656 winupdate.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 2424 DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winupdate.exepid process 1656 winupdate.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exewinlogon.exeephir.execmd.execmd.exedescription pid process target process PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 1992 wrote to memory of 2976 1992 15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe winlogon.exe PID 2976 wrote to memory of 2552 2976 winlogon.exe ephir.exe PID 2976 wrote to memory of 2552 2976 winlogon.exe ephir.exe PID 2976 wrote to memory of 2552 2976 winlogon.exe ephir.exe PID 2976 wrote to memory of 2552 2976 winlogon.exe ephir.exe PID 2552 wrote to memory of 2428 2552 ephir.exe cmd.exe PID 2552 wrote to memory of 2428 2552 ephir.exe cmd.exe PID 2552 wrote to memory of 2428 2552 ephir.exe cmd.exe PID 2552 wrote to memory of 2428 2552 ephir.exe cmd.exe PID 2428 wrote to memory of 2796 2428 cmd.exe attrib.exe PID 2428 wrote to memory of 2796 2428 cmd.exe attrib.exe PID 2428 wrote to memory of 2796 2428 cmd.exe attrib.exe PID 2428 wrote to memory of 2796 2428 cmd.exe attrib.exe PID 2552 wrote to memory of 1656 2552 ephir.exe winupdate.exe PID 2552 wrote to memory of 1656 2552 ephir.exe winupdate.exe PID 2552 wrote to memory of 1656 2552 ephir.exe winupdate.exe PID 2552 wrote to memory of 1656 2552 ephir.exe winupdate.exe PID 2552 wrote to memory of 1656 2552 ephir.exe winupdate.exe PID 2552 wrote to memory of 1656 2552 ephir.exe winupdate.exe PID 2552 wrote to memory of 1656 2552 ephir.exe winupdate.exe PID 2552 wrote to memory of 1864 2552 ephir.exe cmd.exe PID 2552 wrote to memory of 1864 2552 ephir.exe cmd.exe PID 2552 wrote to memory of 1864 2552 ephir.exe cmd.exe PID 2552 wrote to memory of 1864 2552 ephir.exe cmd.exe PID 1864 wrote to memory of 648 1864 cmd.exe PING.EXE PID 1864 wrote to memory of 648 1864 cmd.exe PING.EXE PID 1864 wrote to memory of 648 1864 cmd.exe PING.EXE PID 1864 wrote to memory of 648 1864 cmd.exe PING.EXE -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15e79e75f052a82d3e1a2cd88028596f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\ProgramData\winlogon.exeC:\ProgramData\winlogon.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\ephir.exe"C:\Users\Admin\AppData\Local\Temp\ephir.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\ephir.exe" +s +h4⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\ephir.exe" +s +h5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2796 -
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1656 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\ephir.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 55⤵
- Runs ping.exe
PID:648
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:2424
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD52de3403a72fd77a82f48e40237a105a0
SHA195aebc031614c68585b229b29fe3690d57de731d
SHA256aca69786ef712a7584472dfb0e12ce76845bc717d12642a6f1c7de7f2862a4b9
SHA512b84e1aa98c7f5c5819ae8aec4a180b2bfc0c2d6e6bc0fa057c11069b9edd68c14494141f8972fac696c119e33e536a58391fced23ad4c7db6b70b4916a033b89
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
Filesize
648KB
MD533c3c97354fadb72aeb3af19215a9c0b
SHA1e0e388a7b42facdfd4bb5c6e7466f553575f3d43
SHA25692d939bdbf1517dba637996aa25ab692f1c00b9465f19bb85ceaa09f5545352e
SHA51233d4d18b1b206458f8acf09441ad263a2019639a2fac13acf4725a766335be2aa44c059abfcd10a8dd04f23a947f413f514920e8134d0087275a1779f06dca7e