Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 12:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe
-
Size
78KB
-
MD5
34c6f040fade78d555af9d35373fbbea
-
SHA1
3333eca59fe96957304d8da5de64e9ce8d2e5498
-
SHA256
c6bb0270f6b4c7b90f89bf1c6357737f204e46eff0661db144a5e286bbe3393b
-
SHA512
f33ceacfa4d20b47d33de8bfc04a928d5374497aa18bb19a9ddddfb4219f2fd2934032947760e04ae4448cdb002a1daf7cee15242b90ce091f611ca1601d8e98
-
SSDEEP
1536:XIm5QJiLFTzk2GwW1RKwUbtmi6YSYexeRo/u9eVd32Nt2WMFutmAa:XIGJLF85wWuxtmivDexeRL9Y32rpokmP
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\COM Service = "C:\\Windows\\msagent\\msncbo.pif" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\COM Service = "C:\\Windows\\msagent\\msncbo.pif" svchost.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{42CE4021-DE03-E3CC-EA32-40BB12E6015D} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{42CE4021-DE03-E3CC-EA32-40BB12E6015D}\StubPath = "C:\\Windows\\system32\\msldih.pif" svchost.exe -
Deletes itself 1 IoCs
pid Process 2540 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1988 svchost.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msldih.pif 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe File created C:\Windows\SysWOW64\msldih.pif 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msldih.pif svchost.exe File opened for modification C:\Windows\SysWOW64\msnat.gtx svchost.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\msagent\msncbo.pif 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe File created C:\Windows\msagent\msncbo.pif 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\msagent\msncbo.pif svchost.exe File created C:\Windows\msagent\msncbo.pif svchost.exe File opened for modification C:\Windows\svchost.exe 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe File created C:\Windows\svchost.exe 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1988 svchost.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeSecurityPrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeSystemtimePrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeBackupPrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeRestorePrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeShutdownPrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeDebugPrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeUndockPrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeManageVolumePrivilege 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: 33 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: 34 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: 35 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 1988 svchost.exe Token: SeSecurityPrivilege 1988 svchost.exe Token: SeTakeOwnershipPrivilege 1988 svchost.exe Token: SeLoadDriverPrivilege 1988 svchost.exe Token: SeSystemProfilePrivilege 1988 svchost.exe Token: SeSystemtimePrivilege 1988 svchost.exe Token: SeProfSingleProcessPrivilege 1988 svchost.exe Token: SeIncBasePriorityPrivilege 1988 svchost.exe Token: SeCreatePagefilePrivilege 1988 svchost.exe Token: SeBackupPrivilege 1988 svchost.exe Token: SeRestorePrivilege 1988 svchost.exe Token: SeShutdownPrivilege 1988 svchost.exe Token: SeDebugPrivilege 1988 svchost.exe Token: SeSystemEnvironmentPrivilege 1988 svchost.exe Token: SeRemoteShutdownPrivilege 1988 svchost.exe Token: SeUndockPrivilege 1988 svchost.exe Token: SeManageVolumePrivilege 1988 svchost.exe Token: 33 1988 svchost.exe Token: 34 1988 svchost.exe Token: 35 1988 svchost.exe Token: 33 1988 svchost.exe Token: SeIncBasePriorityPrivilege 1988 svchost.exe Token: 33 1988 svchost.exe Token: SeIncBasePriorityPrivilege 1988 svchost.exe Token: 33 1988 svchost.exe Token: SeIncBasePriorityPrivilege 1988 svchost.exe Token: 33 1988 svchost.exe Token: SeIncBasePriorityPrivilege 1988 svchost.exe Token: 33 1988 svchost.exe Token: SeIncBasePriorityPrivilege 1988 svchost.exe Token: 33 1988 svchost.exe Token: SeIncBasePriorityPrivilege 1988 svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1988 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe 30 PID 2368 wrote to memory of 1988 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe 30 PID 2368 wrote to memory of 1988 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe 30 PID 2368 wrote to memory of 1988 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe 30 PID 2368 wrote to memory of 2540 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe 31 PID 2368 wrote to memory of 2540 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe 31 PID 2368 wrote to memory of 2540 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe 31 PID 2368 wrote to memory of 2540 2368 34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\svchost.exeC:\Windows\svchost.exe2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\34c6f040fade78d555af9d35373fbbea_JaffaCakes118.exe"2⤵
- Deletes itself
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD534c6f040fade78d555af9d35373fbbea
SHA13333eca59fe96957304d8da5de64e9ce8d2e5498
SHA256c6bb0270f6b4c7b90f89bf1c6357737f204e46eff0661db144a5e286bbe3393b
SHA512f33ceacfa4d20b47d33de8bfc04a928d5374497aa18bb19a9ddddfb4219f2fd2934032947760e04ae4448cdb002a1daf7cee15242b90ce091f611ca1601d8e98