Analysis
- max time kernel
144s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
18/08/2024, 22:01
Behavioral task
behavioral1
Sample
a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe
- Size 293KB
- Sample240818-1w96xazepl
- SHA256 12c5ad18a4f7d3c2dea73b7e7eba56acbec3ceb9f0c8d39873dd01ece64e6f0d
- MD5 a861fa8dd36fd96ca1ac027023cb8ee0
- SHA1 ba181f6dae7447cc220b22b5970b7025fc11d335
- SHA512 adcd50b8ee3a5c7227678b69660093175be4375019e7bc0fc33a1e9ee64b096ecc3381f86cde9c6fac06fb1362ae705f40ff8850cf70b70115776d9aa60ce2ac
- SSDEEP 6144:9C8Ty1tI+0tjU6KvBTx+H41K5Syuw5eUQcEjGUXdSLH:9NsN0NU6KvBTMY1Vyuw7QrqkdMH
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE301745-A6FD-4e78-AA71-861F39BC7027}\StubPath = "C:\\Windows\\Fonts\\winsdk.exe -a" winsdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE301745-A6FD-4e78-AA71-861F39BC7027} winsdk.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe - Executes dropped EXE 1 IoCs
pid Process 3980 winsdk.exe -
resource yara_rule behavioral2/memory/2644-0-0x0000000000400000-0x00000000004DB000-memory.dmp upx behavioral2/files/0x000a00000002345f-5.dat upx behavioral2/memory/2644-29-0x0000000000400000-0x00000000004DB000-memory.dmp upx behavioral2/memory/3980-30-0x0000000000400000-0x00000000004DB000-memory.dmp upx behavioral2/memory/3980-32-0x0000000000400000-0x00000000004DB000-memory.dmp upx behavioral2/memory/3980-35-0x0000000000400000-0x00000000004DB000-memory.dmp upx behavioral2/memory/3980-37-0x0000000000400000-0x00000000004DB000-memory.dmp upx behavioral2/memory/3980-38-0x0000000000400000-0x00000000004DB000-memory.dmp upx behavioral2/memory/3980-40-0x0000000000400000-0x00000000004DB000-memory.dmp upx behavioral2/memory/3980-41-0x0000000000400000-0x00000000004DB000-memory.dmp upx behavioral2/memory/3980-43-0x0000000000400000-0x00000000004DB000-memory.dmp upx - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\KeyBoardA.dat winsdk.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\winsdk.exe a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe File opened for modification C:\Windows\Fonts\winsdk.exe a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsdk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: 1 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeCreateTokenPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeLockMemoryPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeMachineAccountPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeTcbPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeSecurityPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeSystemtimePrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeBackupPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeRestorePrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeShutdownPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeDebugPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeAuditPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeUndockPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeSyncAgentPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeEnableDelegationPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeManageVolumePrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeImpersonatePrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe Token: 1 3980 winsdk.exe Token: SeCreateTokenPrivilege 3980 winsdk.exe Token: SeAssignPrimaryTokenPrivilege 3980 winsdk.exe Token: SeLockMemoryPrivilege 3980 winsdk.exe Token: SeIncreaseQuotaPrivilege 3980 winsdk.exe Token: SeMachineAccountPrivilege 3980 winsdk.exe Token: SeTcbPrivilege 3980 winsdk.exe Token: SeSecurityPrivilege 3980 winsdk.exe Token: SeTakeOwnershipPrivilege 3980 winsdk.exe Token: SeLoadDriverPrivilege 3980 winsdk.exe Token: SeSystemProfilePrivilege 3980 winsdk.exe Token: SeSystemtimePrivilege 3980 winsdk.exe Token: SeProfSingleProcessPrivilege 3980 winsdk.exe Token: SeIncBasePriorityPrivilege 3980 winsdk.exe Token: SeCreatePagefilePrivilege 3980 winsdk.exe Token: SeCreatePermanentPrivilege 3980 winsdk.exe Token: SeBackupPrivilege 3980 winsdk.exe Token: SeRestorePrivilege 3980 winsdk.exe Token: SeShutdownPrivilege 3980 winsdk.exe Token: SeDebugPrivilege 3980 winsdk.exe Token: SeAuditPrivilege 3980 winsdk.exe Token: SeSystemEnvironmentPrivilege 3980 winsdk.exe Token: SeChangeNotifyPrivilege 3980 winsdk.exe Token: SeRemoteShutdownPrivilege 3980 winsdk.exe Token: SeUndockPrivilege 3980 winsdk.exe Token: SeSyncAgentPrivilege 3980 winsdk.exe Token: SeEnableDelegationPrivilege 3980 winsdk.exe Token: SeManageVolumePrivilege 3980 winsdk.exe Token: SeImpersonatePrivilege 3980 winsdk.exe Token: SeCreateGlobalPrivilege 3980 winsdk.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe 3980 winsdk.exe 3980 winsdk.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2644 wrote to memory of 3980 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe 87 PID 2644 wrote to memory of 3980 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe 87 PID 2644 wrote to memory of 3980 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe 87 PID 2644 wrote to memory of 60 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe 88 PID 2644 wrote to memory of 60 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe 88 PID 2644 wrote to memory of 60 2644 a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\Fonts\winsdk.exe"C:\Windows\Fonts\winsdk.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3980
-
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\a861fa8dd36fd96ca1ac027023cb8ee0_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
PID:60
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Fonts\winsdk.exe
- Size 293KB
- SHA256 12c5ad18a4f7d3c2dea73b7e7eba56acbec3ceb9f0c8d39873dd01ece64e6f0d
- MD5 a861fa8dd36fd96ca1ac027023cb8ee0
- SHA1 ba181f6dae7447cc220b22b5970b7025fc11d335
- SHA512 adcd50b8ee3a5c7227678b69660093175be4375019e7bc0fc33a1e9ee64b096ecc3381f86cde9c6fac06fb1362ae705f40ff8850cf70b70115776d9aa60ce2ac
- SSDEEP 6144:9C8Ty1tI+0tjU6KvBTx+H41K5Syuw5eUQcEjGUXdSLH:9NsN0NU6KvBTMY1Vyuw7QrqkdMH
- MD5 SHA1 SHA512 SSDEEP