Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 11:15
Behavioral task
behavioral1
Sample
2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe
-
Size
646KB
-
MD5
2c1da74efac76fad043a7f1a7775ffef
-
SHA1
c5845349a0a765c053ba1df5a4ac3ad8678cbb12
-
SHA256
1a99f34af4e5aff31036d724220de23550a156b28eced3cf1ef1d1ef2a7d0435
-
SHA512
5111aaa4bdebcda8fcc6455eef467d0d56b368b730b98bc4a5cdbe0423ad6beac7d2b244d4c84f5ea700f54f050a874f1c7f1f40fe6eda2ad992c2068a4f39f9
-
SSDEEP
12288:A8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixO:5UKoN0bUxgGa/pfBHDb+y1HgZs
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MicroUpdate/MicroUpdate" 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MicroUpdate/MicroUpdate" 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\MicroUpdate\MicroUpdate 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MicroUpdate\MicroUpdate 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2876 set thread context of 2756 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe 30 -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeSecurityPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeSystemtimePrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeBackupPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeRestorePrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeShutdownPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeDebugPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeUndockPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeManageVolumePrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeImpersonatePrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: 33 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: 34 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: 35 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2756 iexplore.exe Token: SeSecurityPrivilege 2756 iexplore.exe Token: SeTakeOwnershipPrivilege 2756 iexplore.exe Token: SeLoadDriverPrivilege 2756 iexplore.exe Token: SeSystemProfilePrivilege 2756 iexplore.exe Token: SeSystemtimePrivilege 2756 iexplore.exe Token: SeProfSingleProcessPrivilege 2756 iexplore.exe Token: SeIncBasePriorityPrivilege 2756 iexplore.exe Token: SeCreatePagefilePrivilege 2756 iexplore.exe Token: SeBackupPrivilege 2756 iexplore.exe Token: SeRestorePrivilege 2756 iexplore.exe Token: SeShutdownPrivilege 2756 iexplore.exe Token: SeDebugPrivilege 2756 iexplore.exe Token: SeSystemEnvironmentPrivilege 2756 iexplore.exe Token: SeChangeNotifyPrivilege 2756 iexplore.exe Token: SeRemoteShutdownPrivilege 2756 iexplore.exe Token: SeUndockPrivilege 2756 iexplore.exe Token: SeManageVolumePrivilege 2756 iexplore.exe Token: SeImpersonatePrivilege 2756 iexplore.exe Token: SeCreateGlobalPrivilege 2756 iexplore.exe Token: 33 2756 iexplore.exe Token: 34 2756 iexplore.exe Token: 35 2756 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2756 iexplore.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2756 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe 30 PID 2876 wrote to memory of 2756 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe 30 PID 2876 wrote to memory of 2756 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe 30 PID 2876 wrote to memory of 2756 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe 30 PID 2876 wrote to memory of 2756 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe 30 PID 2876 wrote to memory of 2756 2876 2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2c1da74efac76fad043a7f1a7775ffef_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2756
-