Analysis
-
max time kernel
134s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 11:20
Behavioral task
behavioral1
Sample
15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe
-
Size
281KB
-
MD5
15ce5e6b5250b42d061f3f536e050457
-
SHA1
0ed82398a4ae86bb491893cd9120d2382f9217d4
-
SHA256
c4658593625145d039fe38ade840edc79dfb2744b0167e6eb802da7d2402cbe7
-
SHA512
b0987126c2dba5118c87d7c8e5ee73a585fca5153659a34b445a1d3b89622b4fd1bd092180fcbccff3d3483cdccddc69d78c160ec60cb1b37ab669436fda2aa7
-
SSDEEP
6144:Oy+phfTwlTLfkixFUQKf3D7TnBAZ5qhbxE:L+p90lYixsfvDBAzK9E
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe" 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe" 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{O622E2J1-76U5-175E-M2WT-38D6DV44UYU4} 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{O622E2J1-76U5-175E-M2WT-38D6DV44UYU4}\StubPath = "C:\\Windows\\system32\\install\\svchost.exe Restart" 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/624-4-0x0000000010410000-0x0000000010482000-memory.dmp upx behavioral2/memory/624-64-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral2/memory/3452-67-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral2/memory/1864-150-0x0000000010590000-0x0000000010602000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\svchost.exe" 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\svchost.exe" 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\install\svchost.exe 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\install\svchost.exe 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 652 3452 WerFault.exe explorer.exe 1524 1864 WerFault.exe 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exepid process 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exepid process 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exedescription pid process target process PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE PID 624 wrote to memory of 3420 624 15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 8124⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15ce5e6b5250b42d061f3f536e050457_JaffaCakes118.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 4764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3452 -ip 34521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1864 -ip 18641⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/624-4-0x0000000010410000-0x0000000010482000-memory.dmpFilesize
456KB
-
memory/624-64-0x0000000010490000-0x0000000010502000-memory.dmpFilesize
456KB
-
memory/1864-150-0x0000000010590000-0x0000000010602000-memory.dmpFilesize
456KB
-
memory/3452-7-0x0000000000470000-0x0000000000471000-memory.dmpFilesize
4KB
-
memory/3452-8-0x0000000000530000-0x0000000000531000-memory.dmpFilesize
4KB
-
memory/3452-66-0x0000000003410000-0x0000000003411000-memory.dmpFilesize
4KB
-
memory/3452-67-0x0000000010490000-0x0000000010502000-memory.dmpFilesize
456KB