Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 01:49
Static task
static1
Behavioral task
behavioral1
Sample
47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe
-
Size
844KB
-
MD5
47b787fefce21508ef8408e9f404267d
-
SHA1
61ac910a258eddab027f27eb5cacb9b66f20fcf5
-
SHA256
5554b40aa6810e1c6f720ab2f90c216c08a95e864666c81313ec44dbdee76d52
-
SHA512
36103a07604c3f355a9834ad2d1008f2e54a88941970e2f37a57548564bb7d1fa58fd7cb8f0e22003e9e3c5e5678a8881fe3dcfe9d10e793379637ecd088f60b
-
SSDEEP
24576:lOZUrs2MwgQgyVAXPK3J/6ZcTxIIuTdj1xsLCi:LPVl/6STxIIadTsL7
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\D5ECXYPCM1.exe = "C:\\Users\\Admin\\AppData\\Roaming\\D5ECXYPCM1.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Temp\svchost.exe = "C:\\Windows\\Temp\\svchost.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 3692 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32 .exe" 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1048 set thread context of 3692 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 4 IoCs
pid Process 964 reg.exe 1740 reg.exe 2256 reg.exe 2680 reg.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe Token: 1 3692 svchost.exe Token: SeCreateTokenPrivilege 3692 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3692 svchost.exe Token: SeLockMemoryPrivilege 3692 svchost.exe Token: SeIncreaseQuotaPrivilege 3692 svchost.exe Token: SeMachineAccountPrivilege 3692 svchost.exe Token: SeTcbPrivilege 3692 svchost.exe Token: SeSecurityPrivilege 3692 svchost.exe Token: SeTakeOwnershipPrivilege 3692 svchost.exe Token: SeLoadDriverPrivilege 3692 svchost.exe Token: SeSystemProfilePrivilege 3692 svchost.exe Token: SeSystemtimePrivilege 3692 svchost.exe Token: SeProfSingleProcessPrivilege 3692 svchost.exe Token: SeIncBasePriorityPrivilege 3692 svchost.exe Token: SeCreatePagefilePrivilege 3692 svchost.exe Token: SeCreatePermanentPrivilege 3692 svchost.exe Token: SeBackupPrivilege 3692 svchost.exe Token: SeRestorePrivilege 3692 svchost.exe Token: SeShutdownPrivilege 3692 svchost.exe Token: SeDebugPrivilege 3692 svchost.exe Token: SeAuditPrivilege 3692 svchost.exe Token: SeSystemEnvironmentPrivilege 3692 svchost.exe Token: SeChangeNotifyPrivilege 3692 svchost.exe Token: SeRemoteShutdownPrivilege 3692 svchost.exe Token: SeUndockPrivilege 3692 svchost.exe Token: SeSyncAgentPrivilege 3692 svchost.exe Token: SeEnableDelegationPrivilege 3692 svchost.exe Token: SeManageVolumePrivilege 3692 svchost.exe Token: SeImpersonatePrivilege 3692 svchost.exe Token: SeCreateGlobalPrivilege 3692 svchost.exe Token: 31 3692 svchost.exe Token: 32 3692 svchost.exe Token: 33 3692 svchost.exe Token: 34 3692 svchost.exe Token: 35 3692 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3692 svchost.exe 3692 svchost.exe 3692 svchost.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1048 wrote to memory of 4620 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 86 PID 1048 wrote to memory of 4620 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 86 PID 1048 wrote to memory of 4620 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 86 PID 4620 wrote to memory of 3892 4620 cmd.exe 88 PID 4620 wrote to memory of 3892 4620 cmd.exe 88 PID 4620 wrote to memory of 3892 4620 cmd.exe 88 PID 1048 wrote to memory of 4764 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 89 PID 1048 wrote to memory of 4764 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 89 PID 1048 wrote to memory of 4764 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 89 PID 1048 wrote to memory of 3692 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 90 PID 1048 wrote to memory of 3692 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 90 PID 1048 wrote to memory of 3692 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 90 PID 1048 wrote to memory of 3692 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 90 PID 1048 wrote to memory of 3692 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 90 PID 1048 wrote to memory of 3692 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 90 PID 1048 wrote to memory of 3692 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 90 PID 1048 wrote to memory of 3692 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 90 PID 1048 wrote to memory of 2264 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 91 PID 1048 wrote to memory of 2264 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 91 PID 1048 wrote to memory of 2264 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 91 PID 1048 wrote to memory of 864 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 92 PID 1048 wrote to memory of 864 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 92 PID 1048 wrote to memory of 864 1048 47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe 92 PID 3692 wrote to memory of 3256 3692 svchost.exe 93 PID 3692 wrote to memory of 3256 3692 svchost.exe 93 PID 3692 wrote to memory of 3256 3692 svchost.exe 93 PID 3692 wrote to memory of 3012 3692 svchost.exe 94 PID 3692 wrote to memory of 3012 3692 svchost.exe 94 PID 3692 wrote to memory of 3012 3692 svchost.exe 94 PID 3692 wrote to memory of 624 3692 svchost.exe 96 PID 3692 wrote to memory of 624 3692 svchost.exe 96 PID 3692 wrote to memory of 624 3692 svchost.exe 96 PID 3692 wrote to memory of 1292 3692 svchost.exe 98 PID 3692 wrote to memory of 1292 3692 svchost.exe 98 PID 3692 wrote to memory of 1292 3692 svchost.exe 98 PID 3892 wrote to memory of 3872 3892 wscript.exe 101 PID 3892 wrote to memory of 3872 3892 wscript.exe 101 PID 3892 wrote to memory of 3872 3892 wscript.exe 101 PID 3256 wrote to memory of 964 3256 cmd.exe 103 PID 3256 wrote to memory of 964 3256 cmd.exe 103 PID 3256 wrote to memory of 964 3256 cmd.exe 103 PID 3012 wrote to memory of 1740 3012 cmd.exe 104 PID 3012 wrote to memory of 1740 3012 cmd.exe 104 PID 3012 wrote to memory of 1740 3012 cmd.exe 104 PID 624 wrote to memory of 2256 624 cmd.exe 105 PID 624 wrote to memory of 2256 624 cmd.exe 105 PID 624 wrote to memory of 2256 624 cmd.exe 105 PID 1292 wrote to memory of 2680 1292 cmd.exe 106 PID 1292 wrote to memory of 2680 1292 cmd.exe 106 PID 1292 wrote to memory of 2680 1292 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\java2.bat3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java2.bat" "4⤵
- Drops startup file
PID:3872
-
-
-
-
C:\Windows\Temp\svchost.exeC:\Windows\Temp\svchost.exe2⤵PID:4764
-
-
C:\Windows\Temp\svchost.exeC:\Windows\Temp\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:964
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\svchost.exe" /t REG_SZ /d "C:\Windows\Temp\svchost.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\svchost.exe" /t REG_SZ /d "C:\Windows\Temp\svchost.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1740
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2256
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\D5ECXYPCM1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\D5ECXYPCM1.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\D5ECXYPCM1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\D5ECXYPCM1.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2680
-
-
-
-
C:\Windows\Temp\svchost.exeC:\Windows\Temp\svchost.exe2⤵PID:2264
-
-
C:\Windows\Temp\svchost.exeC:\Windows\Temp\svchost.exe2⤵PID:864
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78B
MD5c578d9653b22800c3eb6b6a51219bbb8
SHA1a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA25620a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA5123ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
-
Filesize
47B
MD581bf5400486e5da45ba0c6c1399d843f
SHA1d70a7c4d3f3057a3ef5b8b1c764b40b3d3b4d59d
SHA256d1a915a5e0286b1648a6e094f52813e2b5766dce3acf6342b297f7ca113545f1
SHA512ebeee9eb5249ee1b278bf6c1fbcd91e4c073a241203f218dfa2edfa708a37679c6e6a78751de55b4640a024b32ce4389bd5d931401309163950cd15b4a91c140
-
Filesize
151B
MD5ed28c618f7d8306e3736432b58bb5d27
SHA1441e6dab70e31d9c599fcd9e2d32009038781b42
SHA256d9aa03911260779b1f8a9b046a7ecf7aa87b0f13c762491fe8e06c482bac09a3
SHA5124257d8839e881a9ab6de6230a9df1e81456cb796eb9ee2361789fa5fe4c81b297ed1c472f91d97bb0b2ebdb6acadb924617e6ffd32fc96d8ddcebf8fee4a7880
-
Filesize
844KB
MD547b787fefce21508ef8408e9f404267d
SHA161ac910a258eddab027f27eb5cacb9b66f20fcf5
SHA2565554b40aa6810e1c6f720ab2f90c216c08a95e864666c81313ec44dbdee76d52
SHA51236103a07604c3f355a9834ad2d1008f2e54a88941970e2f37a57548564bb7d1fa58fd7cb8f0e22003e9e3c5e5678a8881fe3dcfe9d10e793379637ecd088f60b
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34