Analysis
- max time kernel
150s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system - submitted
08/07/2024, 13:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c7bad4f4a4df3025aa1345db27c7408_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
11 signatures
150 seconds
General
- Target 2c7bad4f4a4df3025aa1345db27c7408_JaffaCakes118.exe
- Size 227KB
- Sample240708-qf9v4ashrc
- SHA256 b9510e4484fa7e3034228337768176fce822162ad819539c6ca3631deac043eb
- MD5 2c7bad4f4a4df3025aa1345db27c7408
- SHA1 93d7fe1ec1f49e1e18c052050e7ff5df4bff4b2c
- SHA512 c23e5d44ca6649d6bb1e227648a6256e9ab81ac4405e748c58bc01105244aa55c3baa592dffe300d4aaafec6663a8cd839e322fd2b3fc98aff117797b0b29d62
- SSDEEP 6144:zLkD+fqCNAl8aVuMULdQrdas2gQntcgMly5CjrjZZ6AnR6e:zYD+iCNAl/HULdQrRfQnegMlcCjeAnRv
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects PlugX payload 20 IoCs
resource yara_rule behavioral2/memory/2908-14-0x00000000022F0000-0x000000000231E000-memory.dmp family_plugx behavioral2/memory/4664-33-0x0000000000E80000-0x0000000000EAE000-memory.dmp family_plugx behavioral2/memory/4196-36-0x0000000000B00000-0x0000000000B2E000-memory.dmp family_plugx behavioral2/memory/4196-35-0x0000000000B00000-0x0000000000B2E000-memory.dmp family_plugx behavioral2/memory/4664-37-0x0000000000E80000-0x0000000000EAE000-memory.dmp family_plugx behavioral2/memory/2908-42-0x00000000022F0000-0x000000000231E000-memory.dmp family_plugx behavioral2/memory/4196-44-0x0000000000B00000-0x0000000000B2E000-memory.dmp family_plugx behavioral2/memory/4196-55-0x0000000000B00000-0x0000000000B2E000-memory.dmp family_plugx behavioral2/memory/4196-56-0x0000000000B00000-0x0000000000B2E000-memory.dmp family_plugx behavioral2/memory/4196-57-0x0000000000B00000-0x0000000000B2E000-memory.dmp family_plugx behavioral2/memory/4196-61-0x0000000000B00000-0x0000000000B2E000-memory.dmp family_plugx behavioral2/memory/4196-63-0x0000000000B00000-0x0000000000B2E000-memory.dmp family_plugx behavioral2/memory/920-64-0x0000000002DC0000-0x0000000002DEE000-memory.dmp family_plugx behavioral2/memory/920-67-0x0000000002DC0000-0x0000000002DEE000-memory.dmp family_plugx behavioral2/memory/920-69-0x0000000002DC0000-0x0000000002DEE000-memory.dmp family_plugx behavioral2/memory/920-66-0x0000000002DC0000-0x0000000002DEE000-memory.dmp family_plugx behavioral2/memory/4196-70-0x0000000000B00000-0x0000000000B2E000-memory.dmp family_plugx behavioral2/memory/4196-73-0x0000000000B00000-0x0000000000B2E000-memory.dmp family_plugx behavioral2/memory/920-76-0x0000000002DC0000-0x0000000002DEE000-memory.dmp family_plugx behavioral2/memory/4196-84-0x0000000000B00000-0x0000000000B2E000-memory.dmp family_plugx - Deletes itself 1 IoCs
pid Process 4196 svchost.exe - Executes dropped EXE 2 IoCs
pid Process 2908 SOUNDMAN.exe 4664 SOUNDMAN.exe - Loads dropped DLL 2 IoCs
pid Process 2908 SOUNDMAN.exe 4664 SOUNDMAN.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\MJ svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\MJ\CLSID = 44003100440044004500440030004400370042003300330036003700360041000000 svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4196 svchost.exe 4196 svchost.exe 4196 svchost.exe 4196 svchost.exe 4196 svchost.exe 4196 svchost.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 4196 svchost.exe 4196 svchost.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 4196 svchost.exe 4196 svchost.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 4196 svchost.exe 4196 svchost.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 4196 svchost.exe 4196 svchost.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe 920 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4196 svchost.exe 920 msiexec.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2908 SOUNDMAN.exe Token: SeTcbPrivilege 2908 SOUNDMAN.exe Token: SeDebugPrivilege 4664 SOUNDMAN.exe Token: SeTcbPrivilege 4664 SOUNDMAN.exe Token: SeDebugPrivilege 4196 svchost.exe Token: SeTcbPrivilege 4196 svchost.exe Token: SeDebugPrivilege 920 msiexec.exe Token: SeTcbPrivilege 920 msiexec.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4356 wrote to memory of 2908 4356 2c7bad4f4a4df3025aa1345db27c7408_JaffaCakes118.exe 85 PID 4356 wrote to memory of 2908 4356 2c7bad4f4a4df3025aa1345db27c7408_JaffaCakes118.exe 85 PID 4356 wrote to memory of 2908 4356 2c7bad4f4a4df3025aa1345db27c7408_JaffaCakes118.exe 85 PID 4664 wrote to memory of 4196 4664 SOUNDMAN.exe 87 PID 4664 wrote to memory of 4196 4664 SOUNDMAN.exe 87 PID 4664 wrote to memory of 4196 4664 SOUNDMAN.exe 87 PID 4664 wrote to memory of 4196 4664 SOUNDMAN.exe 87 PID 4664 wrote to memory of 4196 4664 SOUNDMAN.exe 87 PID 4664 wrote to memory of 4196 4664 SOUNDMAN.exe 87 PID 4664 wrote to memory of 4196 4664 SOUNDMAN.exe 87 PID 4664 wrote to memory of 4196 4664 SOUNDMAN.exe 87 PID 4196 wrote to memory of 920 4196 svchost.exe 88 PID 4196 wrote to memory of 920 4196 svchost.exe 88 PID 4196 wrote to memory of 920 4196 svchost.exe 88 PID 4196 wrote to memory of 920 4196 svchost.exe 88 PID 4196 wrote to memory of 920 4196 svchost.exe 88 PID 4196 wrote to memory of 920 4196 svchost.exe 88 PID 4196 wrote to memory of 920 4196 svchost.exe 88 PID 4196 wrote to memory of 920 4196 svchost.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c7bad4f4a4df3025aa1345db27c7408_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2c7bad4f4a4df3025aa1345db27c7408_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\HID\SOUNDMAN.exe"C:\Users\Admin\AppData\Local\Temp\HID\SOUNDMAN.exe" 100 43562⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
C:\ProgramData\SOUNDMAN\SOUNDMAN.exeC:\ProgramData\SOUNDMAN\SOUNDMAN.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Deletes itself
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:920
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SxS\bug.log
- Size 456B
- SHA256 831f307c1688c876130a90a1e2e0557b398f8424b40cc04cfdd8cc18ff7d38cf
- MD5 f3b1500141e16b0be340e29f9c2c9818
- SHA1 f2c2a8a5c9ee53ae551e5a8ac5f10e25327f42bf
- SHA512 95830d229b4ee8d2064b5068f44ce2f1925900aaaf0dc6eadfedd3f9d4b1a9ffc18cf4a57d63a2798710f877f337fb91e66fbacd104cdb0fa4a3c4d9df895af8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\HID\HID.DLL
- Size 41KB
- SHA256 a8099c7b3748c3b1bff3cd477f3c29bba86ebb6797a08f89f3a661df820adf51
- MD5 89fb8ee88cfd469e14bc7493d78b70c4
- SHA1 0f431b38ef83728e71aa044b06da6e8f989cfbbd
- SHA512 2e0f4838d8edc15e11410f23557dd96cf56ec1e9ad649d50314a3715a66d2adbd7de2ecf19c722df2f9833eee5db15db5b3cfa894e9a3a7df8c0abad2725f1ca
- SSDEEP 768:vjWF21fGHk00ohCYsZDYum7vk1a4XQMRiAl:bWosX0wsZDC+aqRi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\HID\HID.DLLx
- Size 116KB
- SHA256 58302863ae0df9afd3bd8e2746550bf87531d8729c45bb433ee216c66b953094
- MD5 bfebe419cf071d70389dd40f511c26b6
- SHA1 6802ff3f728a0c84c55aea1993101261b84ca839
- SHA512 1df5d20eff499150add83444474191527158cc6ab00c67b04ccdb113116689446a2a9bb45e26f99a7e6741093e2026e15dd6c390e962591287c450d2f09883ea
- SSDEEP 3072:6c6HcWqMPUyuq5GKxHCZ/zhrPlhZPx6A33RB07:6tcgMly5CjrjZZ6AnR67
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\HID\SOUNDMAN.exe
- Size 82KB
- SHA256 54d08331f511823755cbbac3aad698bbcdfcde71f47b827dcfc6ada89e753d80
- MD5 798c0c1ff4e0fce646ca82ae0379ccb0
- SHA1 3f65f997f350a59ac67e432092cf7f5cfe94a701
- SHA512 be7924f6179d774d0e4f91a6f044abbb12e9cbf1e19a49e115da5a2eeedbe4c0b29879cf41008d27d13fdb80963d846527d53721d94668719d1331bf1867de3e
- SSDEEP 1536:2rIZMYzxaRHDM6D4JlU3C3gv74rinWaoBploqF2qaDBC/:yD4JlU3W9inroLloBM
- MD5 SHA1 SHA512 SSDEEP