Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe
-
Size
91KB
-
MD5
8eb3fc6f5b153efb94978771f570f6da
-
SHA1
cc0075ca280e51419ffefd5224069514e57bf7bb
-
SHA256
d0c912b14587f719b5f0dda76d93541dad2b756a9f7aef46d333cff44cfc66df
-
SHA512
a483a2b408be897f9cbc523060da53389ab5cdd7f8c070eca4145e509017de04217548e89e6695165aa9a6a0b72464e42b565d3dc760ec80a0e5cab860707ceb
-
SSDEEP
1536:DNB233APNR21mvJZUqjL+NYXKG53KXgq7z9hO42JVSmd59o:DNB233APNpD+ancCtJVSmd5m
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DllHst = "C:\\Users\\Admin\\LOCALS~1\\APPLIC~1\\MICROS~1\\dllhst3g.exe /waitservice" 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MstInit = "C:\\Windows\\mstinit.exe /waitservice" 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1308 sessmgr.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\mstinit.exe 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe File created C:\Windows\System\sessmgr.exe 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sessmgr.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ClipSrv = "C:\\Users\\Admin\\LOCALS~1\\APPLIC~1\\clipsrv.exe /waitservice" 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3272 wrote to memory of 1308 3272 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe 86 PID 3272 wrote to memory of 1308 3272 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe 86 PID 3272 wrote to memory of 1308 3272 8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8eb3fc6f5b153efb94978771f570f6da_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\System\sessmgr.exeC:\Windows\System\sessmgr.exe /waitservice2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1308
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD58eb3fc6f5b153efb94978771f570f6da
SHA1cc0075ca280e51419ffefd5224069514e57bf7bb
SHA256d0c912b14587f719b5f0dda76d93541dad2b756a9f7aef46d333cff44cfc66df
SHA512a483a2b408be897f9cbc523060da53389ab5cdd7f8c070eca4145e509017de04217548e89e6695165aa9a6a0b72464e42b565d3dc760ec80a0e5cab860707ceb