Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 19:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe
-
Size
360KB
-
MD5
5d56dec0be3cee0baeebfa720dd77400
-
SHA1
dfff930e8babfad960717c2a3e4850f8e81ec897
-
SHA256
568d64af64da08ca74d518cc90929928c29679c5d1878a9f876b80842eead411
-
SHA512
c8d03550f948fea956029e498ba073bdc6d8c4dd1a0cbb195725cf9798b313f16025a757a0eb5b21b4f72c6e31e460df5676e7971fcc10dc981bf82855b7f071
-
SSDEEP
6144:x1pVeNYX/odGomfYyOUdFNFGFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFk:3pVeNVgFNFGFOFwcGF6cmFWc0FWc8cIl
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1896 Avira_AntiVir_Control_Center.exe 2720 winlogon.exe -
Loads dropped DLL 3 IoCs
pid Process 1896 Avira_AntiVir_Control_Center.exe 1896 Avira_AntiVir_Control_Center.exe 1896 Avira_AntiVir_Control_Center.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Firewall\\winlogon.exe" 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 whatismyip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe 2720 winlogon.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe Token: 33 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe Token: SeDebugPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe Token: 33 2720 winlogon.exe Token: SeIncBasePriorityPrivilege 2720 winlogon.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1896 Avira_AntiVir_Control_Center.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3024 wrote to memory of 1896 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 31 PID 3024 wrote to memory of 1896 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 31 PID 3024 wrote to memory of 1896 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 31 PID 3024 wrote to memory of 1896 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 31 PID 3024 wrote to memory of 1896 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 31 PID 3024 wrote to memory of 1896 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 31 PID 3024 wrote to memory of 1896 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 31 PID 3024 wrote to memory of 2720 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 32 PID 3024 wrote to memory of 2720 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 32 PID 3024 wrote to memory of 2720 3024 5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d56dec0be3cee0baeebfa720dd77400_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Roaming\Windows Firewall\Avira_AntiVir_Control_Center.exe"C:\Users\Admin\AppData\Roaming\Windows Firewall\Avira_AntiVir_Control_Center.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1896
-
-
C:\Users\Admin\AppData\Roaming\Windows Firewall\winlogon.exe"C:\Users\Admin\AppData\Roaming\Windows Firewall\winlogon.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD581051bcc2cf1bedf378224b0a93e2877
SHA1ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA2567eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA5121b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
-
Filesize
360KB
MD55d56dec0be3cee0baeebfa720dd77400
SHA1dfff930e8babfad960717c2a3e4850f8e81ec897
SHA256568d64af64da08ca74d518cc90929928c29679c5d1878a9f876b80842eead411
SHA512c8d03550f948fea956029e498ba073bdc6d8c4dd1a0cbb195725cf9798b313f16025a757a0eb5b21b4f72c6e31e460df5676e7971fcc10dc981bf82855b7f071
-
Filesize
24KB
MD57e79d336c4475489c14762dceecb4029
SHA162aa924398ec51de6b621e734b6356329177519e
SHA2561336ac983c6d87bfceccb5850a0883bbd07f533af82a0338323b741dbfd2d3cd
SHA512875f99c1b6abcd7c4d646b3bfc90331611198db67e4a1552fa53b39cbbc876e06cb4b1a915aac2fd10af21c33fc0d60a8859ad9c4f36c3448a83e19c879a1db2