Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe
-
Size
643KB
-
MD5
76091586cb13cdfc5f1105790ba0a554
-
SHA1
81830446c6152c78899ade0e021babb4df72a8a7
-
SHA256
3809fe103d067172f6c16d58db37b4e273f3780db8a626a19fc737f40fd00d7c
-
SHA512
4aa151214f0246a416672d8525899e1aa0b4614b2dd15eaf5b1e33f24466bb262d5fab98be6db09d8ef02767fbdfbf9da9566aa9eb21d4e3620e29729dc57dee
-
SSDEEP
12288:MT5Hn+UaFdwoDEg2m9GQewuGdCXK1kU9hyTU6O2wsJ8QVAfZ+:In+UaFdwogg24GQKAhV6O2wsy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DrvStart = "C:\\Windows\\Media\\HPMedia.exe" 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Media\HPMedia.exe 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe File opened for modification C:\Windows\Media\HPMedia.exe 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe File created C:\Windows\wnetsock08.dll 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2844 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe 2844 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe 2844 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe 2844 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe 2844 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe 2844 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe 2844 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe 2844 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2164 explorer.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeShutdownPrivilege 2680 explorer.exe Token: SeShutdownPrivilege 2680 explorer.exe Token: SeShutdownPrivilege 2164 explorer.exe Token: SeShutdownPrivilege 2164 explorer.exe Token: SeShutdownPrivilege 2164 explorer.exe Token: SeShutdownPrivilege 2164 explorer.exe Token: SeShutdownPrivilege 2164 explorer.exe Token: SeShutdownPrivilege 2164 explorer.exe Token: SeShutdownPrivilege 2164 explorer.exe Token: SeShutdownPrivilege 2164 explorer.exe Token: SeShutdownPrivilege 2164 explorer.exe Token: SeShutdownPrivilege 2164 explorer.exe Token: SeShutdownPrivilege 2164 explorer.exe Token: SeShutdownPrivilege 2164 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2844 wrote to memory of 2164 2844 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe 31 PID 2844 wrote to memory of 2164 2844 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe 31 PID 2844 wrote to memory of 2164 2844 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe 31 PID 2844 wrote to memory of 2164 2844 76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe 31 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2164
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Suspicious use of AdjustPrivilegeToken
PID:2680
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1