Analysis
- max time kernel
148s - max time network
148s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system - submitted
12/07/2024, 07:49
Behavioral task
behavioral1
Sample
3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe
- Size 1.7MB
- Sample240712-jn22wsxamd
- SHA256 8c651078845aa82b8dbd1e716f7790b26b87a605a157e7cdb0ca88f1d86df0b9
- MD5 3c8b4d8f83938f3cbe3c77296f035b1f
- SHA1 97b564685d49e957d28ba3e2514ab4cdf2c7c4a1
- SHA512 a345ce875e076840915138f8a499d49ec99923cb2f3119a3ee6b49e0af2ab95ef751331de3cea2fac032c2ccf5f340b3d58e7b3bc49dc5d36beaf0950ee18e4b
- SSDEEP 24576:5wAcu99lPzvxP+Bsz2XjWTRMQckkIXtIxQuflv9ZOYcRPwIxwkXeE4vvx:yAcIzpP+hickkIdIumlv0IIKkO9
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe - Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile winupdate.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" winupdate.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" winupdate.exe - Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" winupdate.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe - Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe - Executes dropped EXE 2 IoCs
pid Process 2328 USE FOR WIN7 64 BIT AND XP.EXE 2888 winupdate.exe - Loads dropped DLL 5 IoCs
pid Process 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 2888 winupdate.exe 2888 winupdate.exe 2888 winupdate.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2400 set thread context of 2984 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 31 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2984 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeSecurityPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeSystemtimePrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeBackupPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeRestorePrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeShutdownPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeDebugPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeUndockPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeManageVolumePrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeImpersonatePrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: 33 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: 34 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: 35 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2984 explorer.exe Token: SeSecurityPrivilege 2984 explorer.exe Token: SeTakeOwnershipPrivilege 2984 explorer.exe Token: SeLoadDriverPrivilege 2984 explorer.exe Token: SeSystemProfilePrivilege 2984 explorer.exe Token: SeSystemtimePrivilege 2984 explorer.exe Token: SeProfSingleProcessPrivilege 2984 explorer.exe Token: SeIncBasePriorityPrivilege 2984 explorer.exe Token: SeCreatePagefilePrivilege 2984 explorer.exe Token: SeBackupPrivilege 2984 explorer.exe Token: SeRestorePrivilege 2984 explorer.exe Token: SeShutdownPrivilege 2984 explorer.exe Token: SeDebugPrivilege 2984 explorer.exe Token: SeSystemEnvironmentPrivilege 2984 explorer.exe Token: SeChangeNotifyPrivilege 2984 explorer.exe Token: SeRemoteShutdownPrivilege 2984 explorer.exe Token: SeUndockPrivilege 2984 explorer.exe Token: SeManageVolumePrivilege 2984 explorer.exe Token: SeImpersonatePrivilege 2984 explorer.exe Token: SeCreateGlobalPrivilege 2984 explorer.exe Token: 33 2984 explorer.exe Token: 34 2984 explorer.exe Token: 35 2984 explorer.exe Token: SeIncreaseQuotaPrivilege 2888 winupdate.exe Token: SeSecurityPrivilege 2888 winupdate.exe Token: SeTakeOwnershipPrivilege 2888 winupdate.exe Token: SeLoadDriverPrivilege 2888 winupdate.exe Token: SeSystemProfilePrivilege 2888 winupdate.exe Token: SeSystemtimePrivilege 2888 winupdate.exe Token: SeProfSingleProcessPrivilege 2888 winupdate.exe Token: SeIncBasePriorityPrivilege 2888 winupdate.exe Token: SeCreatePagefilePrivilege 2888 winupdate.exe Token: SeBackupPrivilege 2888 winupdate.exe Token: SeRestorePrivilege 2888 winupdate.exe Token: SeShutdownPrivilege 2888 winupdate.exe Token: SeDebugPrivilege 2888 winupdate.exe Token: SeSystemEnvironmentPrivilege 2888 winupdate.exe Token: SeChangeNotifyPrivilege 2888 winupdate.exe Token: SeRemoteShutdownPrivilege 2888 winupdate.exe Token: SeUndockPrivilege 2888 winupdate.exe Token: SeManageVolumePrivilege 2888 winupdate.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2984 explorer.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2328 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 30 PID 2400 wrote to memory of 2328 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 30 PID 2400 wrote to memory of 2328 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 30 PID 2400 wrote to memory of 2328 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 30 PID 2400 wrote to memory of 2984 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 31 PID 2400 wrote to memory of 2984 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 31 PID 2400 wrote to memory of 2984 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 31 PID 2400 wrote to memory of 2984 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 31 PID 2400 wrote to memory of 2984 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 31 PID 2400 wrote to memory of 2984 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 31 PID 2400 wrote to memory of 2888 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2888 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2888 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2888 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2888 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2888 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2888 2400 3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c8b4d8f83938f3cbe3c77296f035b1f_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\USE FOR WIN7 64 BIT AND XP.EXE"C:\Users\Admin\AppData\Local\Temp\USE FOR WIN7 64 BIT AND XP.EXE"2⤵
- Executes dropped EXE
PID:2328
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2984
-
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\TrinityEntertainmentNetwo\USE_FOR_WIN7_64_BIT_AND_X_Url_54bpfc021r4fexvnisupqu2grjkkk1me\1.0.0.0\user.config
- Size 1KB
- SHA256 08c2cd94a43621b3b31aa0aca47a86fc27c42a4ffe4293985492f956f75189ab
- MD5 1d98a0ff9db06eea51cedda06a3aa9db
- SHA1 fd4730a87623d812f0e4a19d90bed21fa85b39a3
- SHA512 b3e16a524889808a25ede42256ab6f41d94616ea75e699c49d2a71df8ad368302f2b69056cf18a57628588c28854e2e3647551b606a4123e49f77e85865e23fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TrinityEntertainmentNetwo\USE_FOR_WIN7_64_BIT_AND_X_Url_54bpfc021r4fexvnisupqu2grjkkk1me\1.0.0.0\user.config
- Size 815B
- SHA256 35a308da6b1c8543bff025f62829387028093ee2c1e88f7ac758b3001ead907d
- MD5 de968ec2cb39dff3e718311f9f7dcc43
- SHA1 09b6ac7be2a74c61599ade84d8b49b7d6036d856
- SHA512 ded7cbc0656fd407979fdc436f551cb26be5ce69583ed90c5595e53e89a060f7c2c890cba0808afa6e1a42f0ca2f4925e042239541fe699ca0112fc2504e3964
- MD5 SHA1 SHA512
- Path C:\Windupdt\winupdate.exe
- Size 1.7MB
- SHA256 8c651078845aa82b8dbd1e716f7790b26b87a605a157e7cdb0ca88f1d86df0b9
- MD5 3c8b4d8f83938f3cbe3c77296f035b1f
- SHA1 97b564685d49e957d28ba3e2514ab4cdf2c7c4a1
- SHA512 a345ce875e076840915138f8a499d49ec99923cb2f3119a3ee6b49e0af2ab95ef751331de3cea2fac032c2ccf5f340b3d58e7b3bc49dc5d36beaf0950ee18e4b
- SSDEEP 24576:5wAcu99lPzvxP+Bsz2XjWTRMQckkIXtIxQuflv9ZOYcRPwIxwkXeE4vvx:yAcIzpP+hickkIdIumlv0IIKkO9
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\USE FOR WIN7 64 BIT AND XP.EXE
- Size 923KB
- SHA256 a5ea58bf25eb008d30fb30d4f9ba792ad61a854f07f5e184f502cf1497b5d93c
- MD5 815e4769047ae810b86d0486c37895c1
- SHA1 134dee5baa11aac8b388e749a77b34d23a78c2eb
- SHA512 658b1295e685e1f84d805fe4ee3d47c996e63eef4e81d562e11b33236c47c87d119ba10cd914bce19444e65843cd3267dab60767f2e053912ad3e09176d6e627
- SSDEEP 12288:MXzvgMPogPLgsEQgu1tgFf3gA/Xf9NvOYXsR18lSwXzvgMPogPLgsEwgLgGeguY:MIxQuflv9ZOYcRPwIxwkXeE
- MD5 SHA1 SHA512 SSDEEP