Analysis
-
max time kernel
4s -
max time network
5s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 21:09
Static task
static1
Behavioral task
behavioral1
Sample
3664c21c5c04d6acb0e25f0abe204195_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3664c21c5c04d6acb0e25f0abe204195_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Errors
General
-
Target
3664c21c5c04d6acb0e25f0abe204195_JaffaCakes118.exe
-
Size
15KB
-
MD5
3664c21c5c04d6acb0e25f0abe204195
-
SHA1
1b62a0defaca0650f19dabd68a104b2caf75a559
-
SHA256
418a7c3366f9590f8b6ee87723cf148b5c2b3b1256a02a2e4574b17ed9424cd2
-
SHA512
a33fb2ba8cd3a08c86aa53a114406199fc8a54f7d92fefe0dc7efc971791669b391ba01862be5338856468110e8c06a1ee81714e7a07e3b7df2b31f87776729f
-
SSDEEP
96:EtTHaHIhQCI+AOxXK22Zr3yMeUDJFhaucDCgYnu475ouRu5uZuduZuRuWJulukuJ:6THaWmZr3yg6fYKzRsLkjyForncCDx
Malware Config
Signatures
-
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "202" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
shutdown.exedescription pid process Token: SeShutdownPrivilege 2984 shutdown.exe Token: SeRemoteShutdownPrivilege 2984 shutdown.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 4816 LogonUI.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
3664c21c5c04d6acb0e25f0abe204195_JaffaCakes118.execmd.exedescription pid process target process PID 720 wrote to memory of 4840 720 3664c21c5c04d6acb0e25f0abe204195_JaffaCakes118.exe cmd.exe PID 720 wrote to memory of 4840 720 3664c21c5c04d6acb0e25f0abe204195_JaffaCakes118.exe cmd.exe PID 720 wrote to memory of 4840 720 3664c21c5c04d6acb0e25f0abe204195_JaffaCakes118.exe cmd.exe PID 4840 wrote to memory of 2984 4840 cmd.exe shutdown.exe PID 4840 wrote to memory of 2984 4840 cmd.exe shutdown.exe PID 4840 wrote to memory of 2984 4840 cmd.exe shutdown.exe PID 720 wrote to memory of 2456 720 3664c21c5c04d6acb0e25f0abe204195_JaffaCakes118.exe cmd.exe PID 720 wrote to memory of 2456 720 3664c21c5c04d6acb0e25f0abe204195_JaffaCakes118.exe cmd.exe PID 720 wrote to memory of 2456 720 3664c21c5c04d6acb0e25f0abe204195_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3664c21c5c04d6acb0e25f0abe204195_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3664c21c5c04d6acb0e25f0abe204195_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c shutdown -r -t 012⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\shutdown.exeshutdown -r -t 013⤵
- Suspicious use of AdjustPrivilegeToken
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c PAUSE2⤵PID:2456
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39ae055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4816