Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
22/07/2024, 10:44
Behavioral task
behavioral1
Sample
62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe
- Size 1005KB
- Sample240722-ms248staqf
- SHA256 0e0baabf913bbe9eaf2ba458cdc336e26e6fd0b2a272de02a67a5e4f83e86af8
- MD5 62ebeb65d67623682463ce7d129484bc
- SHA1 1797ab4a24a7582f243c854498887b0de1b41942
- SHA512 b34e1ebc76cc301e1cc667ce09a1f981f54614c9fea2bae3ef8840bcea5a45c71ef59ad5601442804f5b244038487b6c8da743e4d482c6d12bf343ea2fe54edf
- SSDEEP 24576:xAQ6Zx9cxTmOrucTIEFSpOGop0S0DvLPr:xAQ/TD5EO
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\WindowsUpdate\\winupdate.exe" 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe - Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" explorer.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe - Deletes itself 1 IoCs
pid Process 4480 notepad.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\WindowsUpdate\\winupdate.exe" 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\WindowsUpdate\\winupdate.exe" notepad.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4680 set thread context of 3864 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 93 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3864 explorer.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeSecurityPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeSystemtimePrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeBackupPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeRestorePrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeShutdownPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeDebugPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeUndockPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeManageVolumePrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeImpersonatePrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: 33 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: 34 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: 35 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: 36 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 3864 explorer.exe Token: SeSecurityPrivilege 3864 explorer.exe Token: SeTakeOwnershipPrivilege 3864 explorer.exe Token: SeLoadDriverPrivilege 3864 explorer.exe Token: SeSystemProfilePrivilege 3864 explorer.exe Token: SeSystemtimePrivilege 3864 explorer.exe Token: SeProfSingleProcessPrivilege 3864 explorer.exe Token: SeIncBasePriorityPrivilege 3864 explorer.exe Token: SeCreatePagefilePrivilege 3864 explorer.exe Token: SeBackupPrivilege 3864 explorer.exe Token: SeRestorePrivilege 3864 explorer.exe Token: SeShutdownPrivilege 3864 explorer.exe Token: SeDebugPrivilege 3864 explorer.exe Token: SeSystemEnvironmentPrivilege 3864 explorer.exe Token: SeChangeNotifyPrivilege 3864 explorer.exe Token: SeRemoteShutdownPrivilege 3864 explorer.exe Token: SeUndockPrivilege 3864 explorer.exe Token: SeManageVolumePrivilege 3864 explorer.exe Token: SeImpersonatePrivilege 3864 explorer.exe Token: SeCreateGlobalPrivilege 3864 explorer.exe Token: 33 3864 explorer.exe Token: 34 3864 explorer.exe Token: 35 3864 explorer.exe Token: 36 3864 explorer.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3864 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3152 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3864 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 93 PID 4680 wrote to memory of 3864 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 93 PID 4680 wrote to memory of 3864 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 93 PID 4680 wrote to memory of 3864 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 93 PID 4680 wrote to memory of 3864 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 93 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 4680 wrote to memory of 4480 4680 62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe 94 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95 PID 3864 wrote to memory of 1656 3864 explorer.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\62ebeb65d67623682463ce7d129484bc_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Adds Run key to start application
PID:3152
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe3⤵PID:1656
-
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe2⤵
- Deletes itself
PID:4480
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdate\winupdate.exe
- Size 1005KB
- SHA256 0e0baabf913bbe9eaf2ba458cdc336e26e6fd0b2a272de02a67a5e4f83e86af8
- MD5 62ebeb65d67623682463ce7d129484bc
- SHA1 1797ab4a24a7582f243c854498887b0de1b41942
- SHA512 b34e1ebc76cc301e1cc667ce09a1f981f54614c9fea2bae3ef8840bcea5a45c71ef59ad5601442804f5b244038487b6c8da743e4d482c6d12bf343ea2fe54edf
- SSDEEP 24576:xAQ6Zx9cxTmOrucTIEFSpOGop0S0DvLPr:xAQ/TD5EO
- MD5 SHA1 SHA512 SSDEEP