Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
23/07/2024, 02:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe
- Size 884KB
- Sample240723-cxp1cssdpa
- SHA256 970e0f71cbb5ad431e91ed7a1a323ad1f2d47fe1ae2b54abb470014ac0b671ff
- MD5 65c974e4861e43d082b70835c41f8ff4
- SHA1 2e2b066c97d0a5e460d1d29c937c7fd739fdb0dc
- SHA512 522f4feac4bbbbb8f3994464a1759736fdd046a33b9d86603c81e00219a97c1997b428eaca245499a4ecfeadd3f72cd76ea408ce36d74ce857178903c9e31fd9
- SSDEEP 12288:UiQcPi5wAxVVn+5sGkoESczX6326xF2EU8uutzturY60d/B15ltRZiO/ai2/Sd23:UgwDVV1BI2QF8h6jXBP/iO/JBf
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe - Executes dropped EXE 2 IoCs
pid Process 4120 svchost.exe 2396 svchost.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winzip = "C:\\Users\\Admin\\AppData\\Roaming\\crypttest.exe" 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winzip = "C:\\Users\\Admin\\AppData\\Roaming\\crypttest.exe" 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1604 set thread context of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 4768 set thread context of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 4120 svchost.exe Token: SeSecurityPrivilege 4120 svchost.exe Token: SeTakeOwnershipPrivilege 4120 svchost.exe Token: SeLoadDriverPrivilege 4120 svchost.exe Token: SeSystemProfilePrivilege 4120 svchost.exe Token: SeSystemtimePrivilege 4120 svchost.exe Token: SeProfSingleProcessPrivilege 4120 svchost.exe Token: SeIncBasePriorityPrivilege 4120 svchost.exe Token: SeCreatePagefilePrivilege 4120 svchost.exe Token: SeBackupPrivilege 4120 svchost.exe Token: SeRestorePrivilege 4120 svchost.exe Token: SeShutdownPrivilege 4120 svchost.exe Token: SeDebugPrivilege 4120 svchost.exe Token: SeSystemEnvironmentPrivilege 4120 svchost.exe Token: SeChangeNotifyPrivilege 4120 svchost.exe Token: SeRemoteShutdownPrivilege 4120 svchost.exe Token: SeUndockPrivilege 4120 svchost.exe Token: SeManageVolumePrivilege 4120 svchost.exe Token: SeImpersonatePrivilege 4120 svchost.exe Token: SeCreateGlobalPrivilege 4120 svchost.exe Token: 33 4120 svchost.exe Token: 34 4120 svchost.exe Token: 35 4120 svchost.exe Token: 36 4120 svchost.exe Token: SeDebugPrivilege 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2396 svchost.exe Token: SeSecurityPrivilege 2396 svchost.exe Token: SeTakeOwnershipPrivilege 2396 svchost.exe Token: SeLoadDriverPrivilege 2396 svchost.exe Token: SeSystemProfilePrivilege 2396 svchost.exe Token: SeSystemtimePrivilege 2396 svchost.exe Token: SeProfSingleProcessPrivilege 2396 svchost.exe Token: SeIncBasePriorityPrivilege 2396 svchost.exe Token: SeCreatePagefilePrivilege 2396 svchost.exe Token: SeBackupPrivilege 2396 svchost.exe Token: SeRestorePrivilege 2396 svchost.exe Token: SeShutdownPrivilege 2396 svchost.exe Token: SeDebugPrivilege 2396 svchost.exe Token: SeSystemEnvironmentPrivilege 2396 svchost.exe Token: SeChangeNotifyPrivilege 2396 svchost.exe Token: SeRemoteShutdownPrivilege 2396 svchost.exe Token: SeUndockPrivilege 2396 svchost.exe Token: SeManageVolumePrivilege 2396 svchost.exe Token: SeImpersonatePrivilege 2396 svchost.exe Token: SeCreateGlobalPrivilege 2396 svchost.exe Token: 33 2396 svchost.exe Token: 34 2396 svchost.exe Token: 35 2396 svchost.exe Token: 36 2396 svchost.exe - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4120 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 86 PID 1604 wrote to memory of 4768 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 87 PID 1604 wrote to memory of 4768 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 87 PID 1604 wrote to memory of 4768 1604 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 87 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88 PID 4768 wrote to memory of 2396 4768 65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
C:\Users\Admin\AppData\Local\Temp\65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65c974e4861e43d082b70835c41f8ff4_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\svchost.exe
- Size 1KB
- SHA256 7237db025309d754c54c461685e82fcdf1971dc91d252aa0fea9c2fad4ec92c7
- MD5 a019fc6d1d5c8003f63aba2f78f11377
- SHA1 a6125958cae6b8414f9b7a73c340a14b1e68626d
- SHA512 50c90e406e0db55ccd820ab608d4e02659066f67e0cae177b5abbed1ec0e5122152cbf232777a79fe787ff0b1f0eaec2fd11c36661fac31485bf910c2c36b24a
- MD5 SHA1 SHA512