Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 01:52
Static task
static1
Behavioral task
behavioral1
Sample
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe
-
Size
975KB
-
MD5
185cc9f3e3beacd8b0acb680fc70e8a4
-
SHA1
6cb610e875034fcedcc4ca666a2093947f8feb6a
-
SHA256
047b9549cc08b8749c2157d940bdfb737ea20a2bbf80089715f837b7041bea6d
-
SHA512
ada02977a7a7c97a0de040550c99cd54eb62d701c66709c44f689891981f4bde445614cf9eeab2ce2cef01d89e43c82e9dcd72370b3bcc36cbb17fa2da70a490
-
SSDEEP
12288:ngn5H64rtuq9uHUVsz+peuncYLXjsyBOjxcK1NcCjk+I7lGbl0sDgP3ngbr3aHi2:86MtuGuepHcYLzGjvcCjRI74gIryi
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
WinUdapter.exepid process 2564 WinUdapter.exe -
Loads dropped DLL 2 IoCs
Processes:
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exepid process 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinZip = "C:\\Users\\Admin\\AppData\\Roaming\\leftoverdccrypt.exe" 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exedescription pid process target process PID 1576 set thread context of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
WinUdapter.exedescription pid process Token: SeIncreaseQuotaPrivilege 2564 WinUdapter.exe Token: SeSecurityPrivilege 2564 WinUdapter.exe Token: SeTakeOwnershipPrivilege 2564 WinUdapter.exe Token: SeLoadDriverPrivilege 2564 WinUdapter.exe Token: SeSystemProfilePrivilege 2564 WinUdapter.exe Token: SeSystemtimePrivilege 2564 WinUdapter.exe Token: SeProfSingleProcessPrivilege 2564 WinUdapter.exe Token: SeIncBasePriorityPrivilege 2564 WinUdapter.exe Token: SeCreatePagefilePrivilege 2564 WinUdapter.exe Token: SeBackupPrivilege 2564 WinUdapter.exe Token: SeRestorePrivilege 2564 WinUdapter.exe Token: SeShutdownPrivilege 2564 WinUdapter.exe Token: SeDebugPrivilege 2564 WinUdapter.exe Token: SeSystemEnvironmentPrivilege 2564 WinUdapter.exe Token: SeChangeNotifyPrivilege 2564 WinUdapter.exe Token: SeRemoteShutdownPrivilege 2564 WinUdapter.exe Token: SeUndockPrivilege 2564 WinUdapter.exe Token: SeManageVolumePrivilege 2564 WinUdapter.exe Token: SeImpersonatePrivilege 2564 WinUdapter.exe Token: SeCreateGlobalPrivilege 2564 WinUdapter.exe Token: 33 2564 WinUdapter.exe Token: 34 2564 WinUdapter.exe Token: 35 2564 WinUdapter.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinUdapter.exepid process 2564 WinUdapter.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exedescription pid process target process PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Roaming\WinUdapter.exeC:\Users\Admin\AppData\Roaming\WinUdapter.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57c32886c3cd06d6036c0462301ad289c
SHA1a0a54552a7ecf7082bac0af6c5bca610225b05df
SHA25672c341969754f9e11b85119ca8db22eba2f4a6173c6bac14a032360073799009
SHA51208613b8dc53125c6ff051a98989eb9c4eb447ad05243db1b956ae2969e8463c2a216ed6873274d5b3e890307ad219d761324aa702b3ee45f776b80336147d523