Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 13:30
Static task
static1
Behavioral task
behavioral1
Sample
635befd490efbdf382649cee2c68101e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
635befd490efbdf382649cee2c68101e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
635befd490efbdf382649cee2c68101e_JaffaCakes118.exe
-
Size
728KB
-
MD5
635befd490efbdf382649cee2c68101e
-
SHA1
fe84ae55ee4fcb35715a5c1ddc891e7624b80896
-
SHA256
d38d7ef94c6aa9881ad8660eb9d1db12998842f7e264539fbbac460dc78d1153
-
SHA512
50cdddc79c65226159e319c194eec86946c479930d4e066f2f923cf316cd59ed7f20e0722adb90b34618fc20b7571561ef04da705cb9e300c4eacb188e01eb92
-
SSDEEP
12288:fowD+pYUu7tOZjVrrX8gV0nxjfyZuXhqfdYS8CWcA2p:fowDF7tOZjtBifx6WW
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2884 set thread context of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2868 set thread context of 2656 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 31 -
Program crash 1 IoCs
pid pid_target Process procid_target 2724 2656 WerFault.exe 31 -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeSecurityPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeSystemtimePrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeBackupPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeRestorePrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeShutdownPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeDebugPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeUndockPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeManageVolumePrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeImpersonatePrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: 33 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: 34 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: 35 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeRestorePrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeBackupPrivilege 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2868 2884 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 30 PID 2868 wrote to memory of 2656 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 31 PID 2868 wrote to memory of 2656 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 31 PID 2868 wrote to memory of 2656 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 31 PID 2868 wrote to memory of 2656 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 31 PID 2868 wrote to memory of 2656 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 31 PID 2868 wrote to memory of 2656 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 31 PID 2868 wrote to memory of 2656 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 31 PID 2868 wrote to memory of 2656 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 31 PID 2868 wrote to memory of 2656 2868 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 31 PID 2656 wrote to memory of 2724 2656 explorer.exe 32 PID 2656 wrote to memory of 2724 2656 explorer.exe 32 PID 2656 wrote to memory of 2724 2656 explorer.exe 32 PID 2656 wrote to memory of 2724 2656 explorer.exe 32 PID 2656 wrote to memory of 2724 2656 explorer.exe 32 PID 2656 wrote to memory of 2724 2656 explorer.exe 32 PID 2656 wrote to memory of 2724 2656 explorer.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\635befd490efbdf382649cee2c68101e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\635befd490efbdf382649cee2c68101e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\635befd490efbdf382649cee2c68101e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\635befd490efbdf382649cee2c68101e_JaffaCakes118.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 2524⤵
- Program crash
PID:2724
-
-
-