Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 13:30
Static task
static1
Behavioral task
behavioral1
Sample
635befd490efbdf382649cee2c68101e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
635befd490efbdf382649cee2c68101e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
635befd490efbdf382649cee2c68101e_JaffaCakes118.exe
-
Size
728KB
-
MD5
635befd490efbdf382649cee2c68101e
-
SHA1
fe84ae55ee4fcb35715a5c1ddc891e7624b80896
-
SHA256
d38d7ef94c6aa9881ad8660eb9d1db12998842f7e264539fbbac460dc78d1153
-
SHA512
50cdddc79c65226159e319c194eec86946c479930d4e066f2f923cf316cd59ed7f20e0722adb90b34618fc20b7571561ef04da705cb9e300c4eacb188e01eb92
-
SSDEEP
12288:fowD+pYUu7tOZjVrrX8gV0nxjfyZuXhqfdYS8CWcA2p:fowDF7tOZjtBifx6WW
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 916 set thread context of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 2312 set thread context of 2708 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 93 PID 2708 set thread context of 852 2708 explorer.exe 96 -
Program crash 1 IoCs
pid pid_target Process procid_target 4920 852 WerFault.exe 96 -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeSecurityPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeSystemtimePrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeBackupPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeRestorePrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeShutdownPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeDebugPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeUndockPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeManageVolumePrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeImpersonatePrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: 33 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: 34 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: 35 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe Token: 36 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 916 wrote to memory of 2312 916 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 92 PID 2312 wrote to memory of 2708 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 93 PID 2312 wrote to memory of 2708 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 93 PID 2312 wrote to memory of 2708 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 93 PID 2312 wrote to memory of 2708 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 93 PID 2312 wrote to memory of 2708 2312 635befd490efbdf382649cee2c68101e_JaffaCakes118.exe 93 PID 2708 wrote to memory of 852 2708 explorer.exe 96 PID 2708 wrote to memory of 852 2708 explorer.exe 96 PID 2708 wrote to memory of 852 2708 explorer.exe 96 PID 2708 wrote to memory of 852 2708 explorer.exe 96 PID 2708 wrote to memory of 852 2708 explorer.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\635befd490efbdf382649cee2c68101e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\635befd490efbdf382649cee2c68101e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\635befd490efbdf382649cee2c68101e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\635befd490efbdf382649cee2c68101e_JaffaCakes118.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵PID:852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 85⤵
- Program crash
PID:4920
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 852 -ip 8521⤵PID:2560