Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
17/07/2024, 03:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
11 signatures
150 seconds
General
- Target 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe
- Size 1.1MB
- Sample240717-ekhfvsvdrq
- SHA256 4b5b8b6cd3a5ec359b55556ea1597183e2789bc7b960f685ed1ce0b3a1f709a9
- MD5 5161de9662a9be61d167a37c6a158719
- SHA1 e5e590db667c13f54b1ba8211e2d1a06987d2fce
- SHA512 0de8f98d15f7b2a2a21bc0a7bdc0e078072768dd87d35c12ba3a709b284fd0c91bf92aac5ee0678b74e63ed4317e387acc0d529a710f25701c86a5cbf13f46e5
- SSDEEP 24576:xUZE5VJD+UFtifJlSLFNjnra/43IVoJRO1VRxzK2:xXGUjjmZV7zK2
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe - Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4896 attrib.exe 3664 attrib.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4488 1544 WerFault.exe 97 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3028 set thread context of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 2912 set thread context of 4248 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 91 PID 4248 set thread context of 1544 4248 iexplore.exe 97 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeSecurityPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeSystemtimePrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeBackupPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeRestorePrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeShutdownPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeDebugPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeUndockPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeManageVolumePrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeImpersonatePrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: 33 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: 34 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: 35 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe Token: 36 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 3028 wrote to memory of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 3028 wrote to memory of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 3028 wrote to memory of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 3028 wrote to memory of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 3028 wrote to memory of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 3028 wrote to memory of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 3028 wrote to memory of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 3028 wrote to memory of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 3028 wrote to memory of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 3028 wrote to memory of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 3028 wrote to memory of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 3028 wrote to memory of 2912 3028 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 87 PID 2912 wrote to memory of 4804 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 88 PID 2912 wrote to memory of 4804 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 88 PID 2912 wrote to memory of 4804 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 88 PID 2912 wrote to memory of 3132 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 90 PID 2912 wrote to memory of 3132 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 90 PID 2912 wrote to memory of 3132 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 90 PID 2912 wrote to memory of 4248 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 91 PID 2912 wrote to memory of 4248 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 91 PID 2912 wrote to memory of 4248 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 91 PID 2912 wrote to memory of 4248 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 91 PID 2912 wrote to memory of 4248 2912 5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe 91 PID 3132 wrote to memory of 4896 3132 cmd.exe 93 PID 3132 wrote to memory of 4896 3132 cmd.exe 93 PID 3132 wrote to memory of 4896 3132 cmd.exe 93 PID 4804 wrote to memory of 3664 4804 cmd.exe 94 PID 4804 wrote to memory of 3664 4804 cmd.exe 94 PID 4804 wrote to memory of 3664 4804 cmd.exe 94 PID 4248 wrote to memory of 1544 4248 iexplore.exe 97 PID 4248 wrote to memory of 1544 4248 iexplore.exe 97 PID 4248 wrote to memory of 1544 4248 iexplore.exe 97 PID 4248 wrote to memory of 1544 4248 iexplore.exe 97 PID 4248 wrote to memory of 1544 4248 iexplore.exe 97 PID 4248 wrote to memory of 1544 4248 iexplore.exe 97 PID 4248 wrote to memory of 1544 4248 iexplore.exe 97 PID 4248 wrote to memory of 1544 4248 iexplore.exe 97 PID 4248 wrote to memory of 1544 4248 iexplore.exe 97 PID 4248 wrote to memory of 1544 4248 iexplore.exe 97 PID 4248 wrote to memory of 1544 4248 iexplore.exe 97 PID 4248 wrote to memory of 1544 4248 iexplore.exe 97 PID 4248 wrote to memory of 1544 4248 iexplore.exe 97 - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 4896 attrib.exe 3664 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5161de9662a9be61d167a37c6a158719_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5161de9662a9be61d167a37c6a158719_JaffaCakes118.exe2⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3664
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4896
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵PID:1544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 4045⤵
- Program crash
PID:4488
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1544 -ip 15441⤵PID:3284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
- Size 50B
- SHA256 adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b
- MD5 b774ae3fb1da087e1f83b4f7b2060e5a
- SHA1 97eb9be49ac3af9c851c9e1e84e32bfd53e325a8
- SHA512 f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701
- MD5 SHA1 SHA512