Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 20:21
Static task
static1
Behavioral task
behavioral1
Sample
1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe
-
Size
165KB
-
MD5
1c5eb0e8f00fd584e8d1d3006278fe76
-
SHA1
03f5aa75940b9176a97ac41257f306c33cca93da
-
SHA256
e026f6f1a5a4f5b39e68c8cdb050334174764d2c7fe041073c6e64872a3a4099
-
SHA512
592c5856367f942c29f9f88c7ed20f65eb453475991ffafa11cd72b4c45ca3e58f47af0d4daf6cda2a3800de45789d55596bfcfe3588ee4f7f77417e52474590
-
SSDEEP
3072:yo5Htro+64OBGLvtwT+rGkLB0oA50BFLqlNyoNCzN2D3zCCR9GPU1:351llOBGLvuT+rjLBxAblNyN2zz7RWM
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1844 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118mgr.exe 1740 WerFault.exe -
Loads dropped DLL 9 IoCs
pid Process 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 1740 WerFault.exe 1740 WerFault.exe 1740 WerFault.exe 1740 WerFault.exe 1740 WerFault.exe 1740 WerFault.exe 1740 WerFault.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\SYSWOW64\WERFAULT.EXE 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118mgr.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\setupact.log 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe File opened for modification C:\Windows\Panther\setuperr.log 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe File opened for modification C:\Windows\Panther\diagerr.xml 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe File opened for modification C:\Windows\Panther\diagwrn.xml 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process 1740 1844 WerFault.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Migration 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Migration\IE Installed Date = 20057459f6cbda01 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Migration 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Migration\IE Installed Date = 20057459f6cbda01 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 24 IoCs
pid Process 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe Token: SeRestorePrivilege 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe Token: SeRestorePrivilege 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1844 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118mgr.exe Token: SeRestorePrivilege 1844 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118mgr.exe Token: SeBackupPrivilege 1844 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118mgr.exe Token: SeChangeNotifyPrivilege 1844 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118mgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 852 wrote to memory of 1844 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 29 PID 852 wrote to memory of 1844 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 29 PID 852 wrote to memory of 1844 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 29 PID 852 wrote to memory of 1844 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 29 PID 852 wrote to memory of 372 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 3 PID 852 wrote to memory of 372 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 3 PID 852 wrote to memory of 372 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 3 PID 852 wrote to memory of 372 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 3 PID 852 wrote to memory of 372 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 3 PID 852 wrote to memory of 372 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 3 PID 852 wrote to memory of 372 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 3 PID 852 wrote to memory of 396 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 4 PID 852 wrote to memory of 396 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 4 PID 852 wrote to memory of 396 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 4 PID 852 wrote to memory of 396 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 4 PID 852 wrote to memory of 396 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 4 PID 852 wrote to memory of 396 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 4 PID 852 wrote to memory of 396 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 4 PID 852 wrote to memory of 432 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 5 PID 852 wrote to memory of 432 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 5 PID 852 wrote to memory of 432 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 5 PID 852 wrote to memory of 432 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 5 PID 852 wrote to memory of 432 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 5 PID 852 wrote to memory of 432 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 5 PID 852 wrote to memory of 432 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 5 PID 852 wrote to memory of 480 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 6 PID 852 wrote to memory of 480 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 6 PID 852 wrote to memory of 480 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 6 PID 852 wrote to memory of 480 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 6 PID 852 wrote to memory of 480 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 6 PID 852 wrote to memory of 480 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 6 PID 852 wrote to memory of 480 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 6 PID 852 wrote to memory of 488 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 7 PID 852 wrote to memory of 488 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 7 PID 852 wrote to memory of 488 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 7 PID 852 wrote to memory of 488 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 7 PID 852 wrote to memory of 488 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 7 PID 852 wrote to memory of 488 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 7 PID 852 wrote to memory of 488 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 7 PID 852 wrote to memory of 496 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 8 PID 852 wrote to memory of 496 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 8 PID 852 wrote to memory of 496 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 8 PID 852 wrote to memory of 496 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 8 PID 852 wrote to memory of 496 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 8 PID 852 wrote to memory of 496 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 8 PID 852 wrote to memory of 496 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 8 PID 852 wrote to memory of 604 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 9 PID 852 wrote to memory of 604 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 9 PID 852 wrote to memory of 604 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 9 PID 852 wrote to memory of 604 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 9 PID 852 wrote to memory of 604 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 9 PID 852 wrote to memory of 604 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 9 PID 852 wrote to memory of 604 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 9 PID 852 wrote to memory of 680 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 10 PID 852 wrote to memory of 680 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 10 PID 852 wrote to memory of 680 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 10 PID 852 wrote to memory of 680 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 10 PID 852 wrote to memory of 680 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 10 PID 852 wrote to memory of 680 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 10 PID 852 wrote to memory of 680 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 10 PID 852 wrote to memory of 760 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 11 PID 852 wrote to memory of 760 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 11 PID 852 wrote to memory of 760 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 11 PID 852 wrote to memory of 760 852 1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe 11
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:604
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:2424
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:680
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:760
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:816
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1168
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:860
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:968
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:272
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1008
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1084
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1092
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2304
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2252
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-677212024-73098000-77438666348748318697769356464776911-1326470532-128575295"2⤵PID:1668
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118mgr.exeC:\Users\Admin\AppData\Local\Temp\1c5eb0e8f00fd584e8d1d3006278fe76_JaffaCakes118mgr.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 924⤵
- Executes dropped EXE
- Loads dropped DLL
- Program crash
PID:1740
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5cd963c64ad0bea4ca85a4819f6eefed1
SHA1d9cd6316cf3c6ce5ceec9694c2debc7b7981775f
SHA25633c4b715dc8b183dff9aac65cc42c7f2c70658580b8e3d449878251482a5d906
SHA512f7cd12c57eff3acf7c89b0e7b55dfa81623618a65d6c49b490c199cfe63ae9e858f2681c8ef1425d1e4b25f7b0bbd6d4a9d9788956c23f52fece3d5d79b5907e
-
Filesize
352KB
MD55feab868caedbbd1b7a145ca8261e4aa
SHA1f43f28cc5165608e6fb3794e9a3d083ca2c75f0e
SHA25608bace187a0225e10677de9aa6738a7118be3e5cad6dc45fb8d3366a61bb343c
SHA51291108ab6dd422c1d500fc0a65df6faffdb7000828a0f908b1c053129b4b8702fdb7309fa3f4f6054ad542dfe24fd4853e2fe32f7e45aa369e7a3cb6137bdaca1