Analysis
-
max time kernel
25s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21-07-2024 20:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe
-
Size
234KB
-
MD5
6137c93b084aee6ce49fe56ab35c5a55
-
SHA1
5332f71b391ada36390399af3e6873a78532f7df
-
SHA256
80f26b4a241cc75f8677d3021dec0454a7557c9b5d9a0d1ddc5ab6b9c5da7304
-
SHA512
65f2a0a142c4f56f199f39ccc3ad560a69a6f63a72813165177bf9ccf8fe88be0c0970749ce3aeccb15f6cc0c161775c753820db11d460c18bc3764aa4e75982
-
SSDEEP
6144:A6Gq1/VE4tKQ14jDD/YE5fLrDFPKX5kCzFHKQeu8NcRS4:Ac/VVp14jP/YE5fLrDtKXqCzFHKQeu8y
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications services.exe -
Modifies security service 2 TTPs 26 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0 services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\ErrorControl = "0" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters services.exe -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 -
Uses the VBS compiler for execution 1 TTPs
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_32\Desktop.ini services.exe File created \systemroot\assembly\GAC_64\Desktop.ini services.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 760 set thread context of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Installer\{da45e713-8226-974d-e1b8-8a65f19f6f1a}\@ vbc.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2456 vbc.exe 2456 vbc.exe 2456 vbc.exe 2456 vbc.exe 2456 vbc.exe 460 services.exe 2456 vbc.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2456 vbc.exe Token: SeDebugPrivilege 2456 vbc.exe Token: SeDebugPrivilege 2456 vbc.exe Token: SeDebugPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 760 wrote to memory of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 PID 760 wrote to memory of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 PID 760 wrote to memory of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 PID 760 wrote to memory of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 PID 760 wrote to memory of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 PID 760 wrote to memory of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 PID 760 wrote to memory of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 PID 760 wrote to memory of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 PID 760 wrote to memory of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 PID 760 wrote to memory of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 PID 760 wrote to memory of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 PID 760 wrote to memory of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 PID 760 wrote to memory of 2456 760 6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe 29 PID 2456 wrote to memory of 1192 2456 vbc.exe 20 PID 2456 wrote to memory of 460 2456 vbc.exe 6 PID 2456 wrote to memory of 2800 2456 vbc.exe 30 PID 2456 wrote to memory of 2800 2456 vbc.exe 30 PID 2456 wrote to memory of 2800 2456 vbc.exe 30 PID 2456 wrote to memory of 2800 2456 vbc.exe 30 PID 2456 wrote to memory of 2800 2456 vbc.exe 30 PID 2456 wrote to memory of 2800 2456 vbc.exe 30 PID 2456 wrote to memory of 2800 2456 vbc.exe 30
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:2800
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52a76b89dea933e332acaca08d08e1e7e
SHA155a93aed8ed26d4363cea3f9460b947ea011614f
SHA2561ffdc9c6a071776c061e93d28392dfb11f27a7b1aae216d930f8179066a9af02
SHA51269a9f0530d5cd93abf15bda59862a0c17b5ba4bfce7e4ff53ed827e045b541891f957d014555afccfb4b84f806d6a0b86b94fe122b068ed3e771d47801950851