Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06-07-2024 18:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
291976ba47cec4b3c0e31cbc50ab1923_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
General
-
Target
291976ba47cec4b3c0e31cbc50ab1923_JaffaCakes118.exe
-
Size
236KB
-
MD5
291976ba47cec4b3c0e31cbc50ab1923
-
SHA1
38273b08bd046fc29bd777c9dc4a177ae162b5f8
-
SHA256
a78dbafaca4813307529cafbed554b53a622a639941f2e66520bbb92769ee960
-
SHA512
0b44f02c9d37ba25b9988146bf9a516b65625ed7184c4188689eb4056945cd56e86180e21d7b157faff6acdf4991eec51b18c8d83f084652ef574b0d7ec4158b
-
SSDEEP
3072:1H5VhrQrb6DvbqJMikwRz2Og2QTAxQ4Vt6r+CtbmMjxm8qyCz/xwDSpa:1ZkFkw1vgfCVt6r+l18qjp6Sp
Malware Config
Signatures
-
Detects PlugX payload 19 IoCs
resource yara_rule behavioral1/memory/2008-1-0x0000000000290000-0x00000000002C8000-memory.dmp family_plugx behavioral1/memory/2800-17-0x0000000000770000-0x00000000007A8000-memory.dmp family_plugx behavioral1/memory/2388-22-0x0000000000350000-0x0000000000388000-memory.dmp family_plugx behavioral1/memory/2636-29-0x00000000001C0000-0x00000000001F8000-memory.dmp family_plugx behavioral1/memory/2388-39-0x0000000000350000-0x0000000000388000-memory.dmp family_plugx behavioral1/memory/2636-31-0x00000000001C0000-0x00000000001F8000-memory.dmp family_plugx behavioral1/memory/2636-47-0x00000000001C0000-0x00000000001F8000-memory.dmp family_plugx behavioral1/memory/2008-49-0x0000000000290000-0x00000000002C8000-memory.dmp family_plugx behavioral1/memory/2636-53-0x00000000001C0000-0x00000000001F8000-memory.dmp family_plugx behavioral1/memory/2636-48-0x00000000001C0000-0x00000000001F8000-memory.dmp family_plugx behavioral1/memory/2636-46-0x00000000001C0000-0x00000000001F8000-memory.dmp family_plugx behavioral1/memory/2636-54-0x00000000001C0000-0x00000000001F8000-memory.dmp family_plugx behavioral1/memory/2800-58-0x0000000000770000-0x00000000007A8000-memory.dmp family_plugx behavioral1/memory/2436-67-0x00000000002B0000-0x00000000002E8000-memory.dmp family_plugx behavioral1/memory/2436-70-0x00000000002B0000-0x00000000002E8000-memory.dmp family_plugx behavioral1/memory/2436-69-0x00000000002B0000-0x00000000002E8000-memory.dmp family_plugx behavioral1/memory/2636-71-0x00000000001C0000-0x00000000001F8000-memory.dmp family_plugx behavioral1/memory/2636-72-0x00000000001C0000-0x00000000001F8000-memory.dmp family_plugx behavioral1/memory/2636-74-0x00000000001C0000-0x00000000001F8000-memory.dmp family_plugx -
Deletes itself 1 IoCs
pid Process 2800 NvSmart.exe -
Executes dropped EXE 2 IoCs
pid Process 2800 NvSmart.exe 2388 NvSmart.exe -
Loads dropped DLL 2 IoCs
pid Process 2800 NvSmart.exe 2388 NvSmart.exe -
Modifies data under HKEY_USERS 31 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F316CF33-43A0-4FC4-B521-DA0727DCE3A0}\WpadDecision = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-eb-7e-10-10-1b\WpadDecisionTime = 20f671a3d7cfda01 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F316CF33-43A0-4FC4-B521-DA0727DCE3A0} svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-eb-7e-10-10-1b\WpadDetectedUrl svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-eb-7e-10-10-1b\WpadDecisionTime = e049c4e2d7cfda01 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-eb-7e-10-10-1b\WpadDecisionTime = e03a52ebd7cfda01 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F316CF33-43A0-4FC4-B521-DA0727DCE3A0}\WpadDecisionTime = e03a52ebd7cfda01 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F316CF33-43A0-4FC4-B521-DA0727DCE3A0}\WpadNetworkName = "Network 3" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F316CF33-43A0-4FC4-B521-DA0727DCE3A0}\32-eb-7e-10-10-1b svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-eb-7e-10-10-1b svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F316CF33-43A0-4FC4-B521-DA0727DCE3A0}\WpadDecisionTime = a0be18c3d7cfda01 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F316CF33-43A0-4FC4-B521-DA0727DCE3A0}\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F316CF33-43A0-4FC4-B521-DA0727DCE3A0}\WpadDecisionTime = 20f671a3d7cfda01 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-eb-7e-10-10-1b\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F316CF33-43A0-4FC4-B521-DA0727DCE3A0}\WpadDecisionTime = e049c4e2d7cfda01 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-eb-7e-10-10-1b\WpadDecision = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-eb-7e-10-10-1b\WpadDecisionTime = a0be18c3d7cfda01 svchost.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 39003600380036003000320042004600320032003600410034003200440036000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2636 svchost.exe 2636 svchost.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2636 svchost.exe 2636 svchost.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2636 svchost.exe 2636 svchost.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2636 svchost.exe 2636 svchost.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2436 msiexec.exe 2636 svchost.exe 2636 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2636 svchost.exe 2436 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2008 291976ba47cec4b3c0e31cbc50ab1923_JaffaCakes118.exe Token: SeTcbPrivilege 2008 291976ba47cec4b3c0e31cbc50ab1923_JaffaCakes118.exe Token: SeDebugPrivilege 2800 NvSmart.exe Token: SeTcbPrivilege 2800 NvSmart.exe Token: SeDebugPrivilege 2388 NvSmart.exe Token: SeTcbPrivilege 2388 NvSmart.exe Token: SeDebugPrivilege 2636 svchost.exe Token: SeTcbPrivilege 2636 svchost.exe Token: SeDebugPrivilege 2436 msiexec.exe Token: SeTcbPrivilege 2436 msiexec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2636 2388 NvSmart.exe 31 PID 2388 wrote to memory of 2636 2388 NvSmart.exe 31 PID 2388 wrote to memory of 2636 2388 NvSmart.exe 31 PID 2388 wrote to memory of 2636 2388 NvSmart.exe 31 PID 2388 wrote to memory of 2636 2388 NvSmart.exe 31 PID 2388 wrote to memory of 2636 2388 NvSmart.exe 31 PID 2388 wrote to memory of 2636 2388 NvSmart.exe 31 PID 2388 wrote to memory of 2636 2388 NvSmart.exe 31 PID 2388 wrote to memory of 2636 2388 NvSmart.exe 31 PID 2636 wrote to memory of 2436 2636 svchost.exe 32 PID 2636 wrote to memory of 2436 2636 svchost.exe 32 PID 2636 wrote to memory of 2436 2636 svchost.exe 32 PID 2636 wrote to memory of 2436 2636 svchost.exe 32 PID 2636 wrote to memory of 2436 2636 svchost.exe 32 PID 2636 wrote to memory of 2436 2636 svchost.exe 32 PID 2636 wrote to memory of 2436 2636 svchost.exe 32 PID 2636 wrote to memory of 2436 2636 svchost.exe 32 PID 2636 wrote to memory of 2436 2636 svchost.exe 32 PID 2636 wrote to memory of 2436 2636 svchost.exe 32 PID 2636 wrote to memory of 2436 2636 svchost.exe 32 PID 2636 wrote to memory of 2436 2636 svchost.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\291976ba47cec4b3c0e31cbc50ab1923_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\291976ba47cec4b3c0e31cbc50ab1923_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
C:\ProgramData\SxS\NvSmart.exe"C:\ProgramData\SxS\NvSmart.exe" 100 20081⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
C:\ProgramData\SxS\NvSmart.exe"C:\ProgramData\SxS\NvSmart.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 26363⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD509b8b54f78a10c435cd319070aa13c28
SHA16474d0369f97e72e01e4971128d1062f5c2b3656
SHA256523d28df917f9d265cd2c0d38df26277bc56a535145100ed82e6f5fdeaae7256
SHA512c1f2f5c4aa5eb55d255e22db032da954a38a0204fb4d9bc76042f140f1b1e171944aa09b0eb11159323a8b9f33974c73fd32a4f76d976aaa8a16cc9c60a34ca7
-
Filesize
5KB
MD5ff338690b8c399341981dcbcaf3af02c
SHA15162c70b2ae0b434cab7d9871dbd9a1dac14ec45
SHA2565304d00250196a8cd5e9a81e053a886d1a291e4615484e49ff537bebecc13976
SHA5124c4394b9675d0ab01d2fc8d4a765411fb83700ae58d86b4c71452563931cb50ff1ed60ac637099e89bf0d49f939b4c7eaa4e168c1c2baa1b04e8e80fff37e5a3
-
Filesize
622B
MD506116939d10957c18214fc160a01bcc1
SHA12971d994c88dc07afd0a2763239182da18869d61
SHA2562a3057255eb3b019d6f1251e3e5c727752bb9c90c1fe5634cba4fcd18ce34e1a
SHA5125fa4008fed3ae9853d08eb832e35c39d73ab9afe5276d4744057082278c7e5cfddc1588bc677b2d504a7b90a174c3091841831570e7bf1864c9c3c872102a320
-
Filesize
155KB
MD564dce06ff017f3613b3360f3fa2200b6
SHA1df7b71bbc1e40a8a3ef52ba8a744f2572608eb9c
SHA2563b3f5f30ec0ef0a061e322c55e3ab55f095b6bd346ebecf3ba6970180ccf2c93
SHA512f1924ed6f8c430422939c6c37fc1349ecbc81bef4dded66d71facb2246da9dc12dab0a3738d05df4c4cee3bba141eaa0d02fcd17505b2c5eb0fa2e49aec63410