Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 16:38
Static task
static1
Behavioral task
behavioral1
Sample
63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe
-
Size
668KB
-
MD5
63f2fc876c09c7a6a1700612e479f251
-
SHA1
36acdc5c72b3159ce9b2764259a3c208ff2d4f54
-
SHA256
4a2b8775c52b3594c1e8889afdf96c1477853d5b912b3ede8248fa306da74bcd
-
SHA512
9bdd352918b393a5a8d39f0b1535cea00f21a2127ebaca992dc159895549a6b5c7efe057442831d959dc7fdc166f5d3e5a9b77dd50fa0899c9abe117542e6647
-
SSDEEP
12288:+oiyf03HDkrzviq6C09GZPQcxaBOzcL75WmnTKWfg0wxXSjqT9tMM/GU9fWXaFQI:+oIHgnq5IOKFQB2Fakn
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Updates\\winupdate.exe" vbc.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts vbc.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vbc.exe -
Executes dropped EXE 1 IoCs
pid Process 4252 winupdate.exe -
resource yara_rule behavioral2/memory/5116-3-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5116-4-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5116-6-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5116-7-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5116-8-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5116-9-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5116-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdater32 = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Updates\\winupdate.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1508 set thread context of 5116 1508 63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe 84 -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier vbc.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier vbc.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ vbc.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5116 vbc.exe Token: SeSecurityPrivilege 5116 vbc.exe Token: SeTakeOwnershipPrivilege 5116 vbc.exe Token: SeLoadDriverPrivilege 5116 vbc.exe Token: SeSystemProfilePrivilege 5116 vbc.exe Token: SeSystemtimePrivilege 5116 vbc.exe Token: SeProfSingleProcessPrivilege 5116 vbc.exe Token: SeIncBasePriorityPrivilege 5116 vbc.exe Token: SeCreatePagefilePrivilege 5116 vbc.exe Token: SeBackupPrivilege 5116 vbc.exe Token: SeRestorePrivilege 5116 vbc.exe Token: SeShutdownPrivilege 5116 vbc.exe Token: SeDebugPrivilege 5116 vbc.exe Token: SeSystemEnvironmentPrivilege 5116 vbc.exe Token: SeChangeNotifyPrivilege 5116 vbc.exe Token: SeRemoteShutdownPrivilege 5116 vbc.exe Token: SeUndockPrivilege 5116 vbc.exe Token: SeManageVolumePrivilege 5116 vbc.exe Token: SeImpersonatePrivilege 5116 vbc.exe Token: SeCreateGlobalPrivilege 5116 vbc.exe Token: 33 5116 vbc.exe Token: 34 5116 vbc.exe Token: 35 5116 vbc.exe Token: 36 5116 vbc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1508 wrote to memory of 5116 1508 63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe 84 PID 1508 wrote to memory of 5116 1508 63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe 84 PID 1508 wrote to memory of 5116 1508 63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe 84 PID 1508 wrote to memory of 5116 1508 63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe 84 PID 1508 wrote to memory of 5116 1508 63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe 84 PID 1508 wrote to memory of 5116 1508 63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe 84 PID 1508 wrote to memory of 5116 1508 63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe 84 PID 1508 wrote to memory of 5116 1508 63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe 84 PID 5116 wrote to memory of 4904 5116 vbc.exe 86 PID 5116 wrote to memory of 4904 5116 vbc.exe 86 PID 5116 wrote to memory of 4904 5116 vbc.exe 86 PID 5116 wrote to memory of 4252 5116 vbc.exe 89 PID 5116 wrote to memory of 4252 5116 vbc.exe 89 PID 5116 wrote to memory of 4252 5116 vbc.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks BIOS information in registry
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵PID:4904
-
-
C:\Users\Admin\AppData\Roaming\Windows\Updates\winupdate.exe"C:\Users\Admin\AppData\Roaming\Windows\Updates\winupdate.exe"3⤵
- Executes dropped EXE
PID:4252
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34