Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
12/07/2024, 16:53
Behavioral task
behavioral1
Sample
3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
15 signatures
150 seconds
General
- Target 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe
- Size 658KB
- Sample240712-vd7p6ssark
- SHA256 d0cc062a000182c0fb430cf619a172ab2c4b53dc20c60e19088be3cbfb43ae01
- MD5 3e2275a33afa927db7216bc6f8d43e6f
- SHA1 876c7bbc0f032cca126201f4b8ddbf43759e5a9f
- SHA512 d32bb1c7b87aa5f40864b1245bbebc2cc78044729496b140ae44365a2c970572f0d178667163b7d3cb397c2f3c71227561d05f0536a7a6f1a00539be5464e72e
- SSDEEP 12288:x9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnK/:HAQ6Zx9cxTmOrucTIEFSpOG+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" explorer.exe - Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" explorer.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe - Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe - Disables Task Manager via registry modification
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3520 set thread context of 2588 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe 84 - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2588 explorer.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeSecurityPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeLoadDriverPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeSystemProfilePrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeSystemtimePrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeBackupPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeRestorePrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeShutdownPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeDebugPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeUndockPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeManageVolumePrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeImpersonatePrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: 33 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: 34 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: 35 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: 36 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2588 explorer.exe Token: SeSecurityPrivilege 2588 explorer.exe Token: SeTakeOwnershipPrivilege 2588 explorer.exe Token: SeLoadDriverPrivilege 2588 explorer.exe Token: SeSystemProfilePrivilege 2588 explorer.exe Token: SeSystemtimePrivilege 2588 explorer.exe Token: SeProfSingleProcessPrivilege 2588 explorer.exe Token: SeIncBasePriorityPrivilege 2588 explorer.exe Token: SeCreatePagefilePrivilege 2588 explorer.exe Token: SeBackupPrivilege 2588 explorer.exe Token: SeRestorePrivilege 2588 explorer.exe Token: SeShutdownPrivilege 2588 explorer.exe Token: SeDebugPrivilege 2588 explorer.exe Token: SeSystemEnvironmentPrivilege 2588 explorer.exe Token: SeChangeNotifyPrivilege 2588 explorer.exe Token: SeRemoteShutdownPrivilege 2588 explorer.exe Token: SeUndockPrivilege 2588 explorer.exe Token: SeManageVolumePrivilege 2588 explorer.exe Token: SeImpersonatePrivilege 2588 explorer.exe Token: SeCreateGlobalPrivilege 2588 explorer.exe Token: 33 2588 explorer.exe Token: 34 2588 explorer.exe Token: 35 2588 explorer.exe Token: 36 2588 explorer.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3520 wrote to memory of 2588 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe 84 PID 3520 wrote to memory of 2588 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe 84 PID 3520 wrote to memory of 2588 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe 84 PID 3520 wrote to memory of 2588 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe 84 PID 3520 wrote to memory of 2588 3520 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe 84 - System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" 3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3e2275a33afa927db7216bc6f8d43e6f_JaffaCakes118.exe"1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks BIOS information in registry
- Windows security modification
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3520 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2588
-