Analysis
- max time kernel
150s - max time network
121s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system - submitted
19/07/2024, 00:09
Behavioral task
behavioral1
Sample
59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
17 signatures
150 seconds
General
- Target 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
- Size 346KB
- Sample240719-aflv9stdkk
- SHA256 7b3e2af8f39bcf2eda1f99830f4a0c8fc9a2d27fe6887208dbdd240dbd0b73c8
- MD5 59ac156dc89fec0e11f948f5f910dc07
- SHA1 83e97a2cc60b79bc486f5ce2595f767451a4d470
- SHA512 56e3de12d0b2a96f94d693a81fd59ca11164edc5bca744e6fac9e98061c9a892d48c9729a073f6b09eadc048523aeaf57a155759f5de0999e654a1d91bb0ca10
- SSDEEP 6144:RFRaI2EqBP/WsZL1PgLl4w0AidVym0EnarUBYVsfwc4LLsMdWnpQZh9h4:jR72EqluswR45JTnaEY2fpXMd0QZh9u
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe - Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" iexplore.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe - Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe - Disables Task Manager via registry modification
- Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2644 attrib.exe 1980 attrib.exe -
resource yara_rule behavioral1/memory/1812-0-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/2836-2-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/1812-4-0x0000000000400000-0x00000000004E5000-memory.dmp upx -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1812 set thread context of 2836 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 32 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2836 iexplore.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeSecurityPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeSystemtimePrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeBackupPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeRestorePrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeShutdownPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeDebugPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeUndockPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeManageVolumePrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeImpersonatePrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: 33 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: 34 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: 35 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2836 iexplore.exe Token: SeSecurityPrivilege 2836 iexplore.exe Token: SeTakeOwnershipPrivilege 2836 iexplore.exe Token: SeLoadDriverPrivilege 2836 iexplore.exe Token: SeSystemProfilePrivilege 2836 iexplore.exe Token: SeSystemtimePrivilege 2836 iexplore.exe Token: SeProfSingleProcessPrivilege 2836 iexplore.exe Token: SeIncBasePriorityPrivilege 2836 iexplore.exe Token: SeCreatePagefilePrivilege 2836 iexplore.exe Token: SeBackupPrivilege 2836 iexplore.exe Token: SeRestorePrivilege 2836 iexplore.exe Token: SeShutdownPrivilege 2836 iexplore.exe Token: SeDebugPrivilege 2836 iexplore.exe Token: SeSystemEnvironmentPrivilege 2836 iexplore.exe Token: SeChangeNotifyPrivilege 2836 iexplore.exe Token: SeRemoteShutdownPrivilege 2836 iexplore.exe Token: SeUndockPrivilege 2836 iexplore.exe Token: SeManageVolumePrivilege 2836 iexplore.exe Token: SeImpersonatePrivilege 2836 iexplore.exe Token: SeCreateGlobalPrivilege 2836 iexplore.exe Token: 33 2836 iexplore.exe Token: 34 2836 iexplore.exe Token: 35 2836 iexplore.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2836 iexplore.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1812 wrote to memory of 2740 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 30 PID 1812 wrote to memory of 2740 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 30 PID 1812 wrote to memory of 2740 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 30 PID 1812 wrote to memory of 2740 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 30 PID 1812 wrote to memory of 2764 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 31 PID 1812 wrote to memory of 2764 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 31 PID 1812 wrote to memory of 2764 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 31 PID 1812 wrote to memory of 2764 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 31 PID 1812 wrote to memory of 2836 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 32 PID 1812 wrote to memory of 2836 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 32 PID 1812 wrote to memory of 2836 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 32 PID 1812 wrote to memory of 2836 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 32 PID 1812 wrote to memory of 2836 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 32 PID 1812 wrote to memory of 2836 1812 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe 32 PID 2740 wrote to memory of 2644 2740 cmd.exe 35 PID 2740 wrote to memory of 2644 2740 cmd.exe 35 PID 2740 wrote to memory of 2644 2740 cmd.exe 35 PID 2740 wrote to memory of 2644 2740 cmd.exe 35 PID 2764 wrote to memory of 1980 2764 cmd.exe 36 PID 2764 wrote to memory of 1980 2764 cmd.exe 36 PID 2764 wrote to memory of 1980 2764 cmd.exe 36 PID 2764 wrote to memory of 1980 2764 cmd.exe 36 - System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" 59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2644 attrib.exe 1980 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe"1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1812 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2644
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1980
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2836
-