Analysis
-
max time kernel
92s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
12-07-2024 23:04
General
-
Target
3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe
-
Size
7.4MB
-
MD5
3f3ad2ecae96a7640ec6f0272a7626b9
-
SHA1
cfe1ca816755f04c055a8d238a0077aeb3b22cf1
-
SHA256
f7d20a05b51c7896cd9a716f55e983e43b02390d042642c0969bffff478e14b3
-
SHA512
64a3d9519d3c5ba92ef738a17313900516fbad977f32d7549b1ec47373d8ca8dac5cfef493b924664738d42e489a59c95ee01a40a57b1e3f34e655eed374f2ea
-
SSDEEP
768:xvEk/bzQ7RlxhvtpjRR7ePoxBz1d4oJoobHYJJSmjppwIiSTsWbR3b+xhv97jZ6L:xJF
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Windows security bypass 2 TTPs 3 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Orcurs Rat Executable 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Windows security modification 2 TTPs 11 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 6883⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 22482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2064 -ip 20641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1412 -ip 14121⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
4Disable or Modify Tools
4Modify Registry
6Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD52debcf05ecc2e2bd558a647b88be38d7
SHA1db8e49146a0dada3562f6602fe4387fe6f932441
SHA2565098dd8cc10f3e57134314904fda38b161b9034438151505d0c24d2219284855
SHA51212b97b315089545cfe5ccee50b06f22bba7c4a21cdd52d25f85e9dec1ecbe71da69fa8394008badc50fdd38aa95b6b35d3e21fdca90168cd1cb1d4093662a2db
-
Filesize
18KB
MD5ad6d259abdca2fdff89ff604273b95b0
SHA1fc63fcc01458813090452f988ef1487fbe47946c
SHA2569e388b5cc98f8490b7992e3a3a1bf6acaa21bc4f702e999a9b24fd8fb1fdf666
SHA5128b38cc699de38c8b06486b91921164363ef369f2cdc095cf33d8092d3c1d9ad08f2403cb6cca4f3d9451a8c29d3ad5cb801dcbaea020c3f45b72dad5e7c2ac61
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
32KB
-
Filesize
304KB
-
Filesize
6.5MB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
104KB
-
Filesize
1000KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
1.1MB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
7.4MB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
104KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
200KB
-
Filesize
304KB
-
Filesize
216KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
136KB
-
Filesize
600KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
652KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
80KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
304KB