Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 09:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe
-
Size
204KB
-
MD5
19aa09f75b49899cc38db71a5fda941b
-
SHA1
094ed1c8001dbedd576f07e58f81eabd9c6f8bc9
-
SHA256
d734f11b95365b25f5381a85aea3df11a420865d5245e56136ee2d252aeb3e5e
-
SHA512
2e93c3b5c4efcbd9dc96fb7d56a2ca046f425086d3c265336e8170c0a5208e3bea558d6b5993f93fd4b62b84fe1629e088b2123b02522ad19dbfa92bd68bd8dc
-
SSDEEP
3072:T2+RDecvxm9T44toxKaJ0lKKDvbzo/nCYczSY2RhfSbwes4YfM:T2+Ryc5QT44nc0h7b8/pc+zRhq8e
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 2324 itc.exe -
Executes dropped EXE 1 IoCs
pid Process 2324 itc.exe -
Loads dropped DLL 2 IoCs
pid Process 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe -
Modifies system executable filetype association 2 TTPs 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\runas itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\runas\command itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\start\command itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\Content Type = "application/x-msdownload" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\DefaultIcon\ = "%1" itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\start itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\ = "Application" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\itc.exe\" -a \"%1\" %*" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\DefaultIcon itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell itc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\WINDOWS\\system32\\ctfmon.exe" itc.exe -
Modifies registry class 41 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\DefaultIcon itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\shell\runas itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\DefaultIcon\ = "%1" itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\itc.exe\" -a \"%1\" %*" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\ = "exefile" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\Content Type = "application/x-msdownload" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\DefaultIcon\ = "%1" itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\shell itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\shell\open\command itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\shell\start\command\IsolatedCommand = "\"%1\" %*" itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\runas itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\start itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\DefaultIcon itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open itc.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\shell\runas\command itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\shell\start\command\ = "\"%1\" %*" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\ = "Application" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\runas\command itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\shell\start\command itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\start\command itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\itc.exe\" -a \"%1\" %*" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\shell\start itc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\Content Type = "application/x-msdownload" itc.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.exe\shell\open itc.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2632 explorer.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe Token: SeShutdownPrivilege 2632 explorer.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 2324 itc.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2324 itc.exe 2632 explorer.exe 2632 explorer.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2632 explorer.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2632 explorer.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2324 itc.exe 2632 explorer.exe 2324 itc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2324 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 28 PID 2084 wrote to memory of 2324 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 28 PID 2084 wrote to memory of 2324 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 28 PID 2084 wrote to memory of 2324 2084 19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe 28 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\itc.exe"C:\Users\Admin\AppData\Local\itc.exe" -gav C:\Users\Admin\AppData\Local\Temp\19aa09f75b49899cc38db71a5fda941b_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2324
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2632
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD519aa09f75b49899cc38db71a5fda941b
SHA1094ed1c8001dbedd576f07e58f81eabd9c6f8bc9
SHA256d734f11b95365b25f5381a85aea3df11a420865d5245e56136ee2d252aeb3e5e
SHA5122e93c3b5c4efcbd9dc96fb7d56a2ca046f425086d3c265336e8170c0a5208e3bea558d6b5993f93fd4b62b84fe1629e088b2123b02522ad19dbfa92bd68bd8dc