Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2024 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe
-
Size
60KB
-
MD5
ac5b74bde9b37320fd66c2f25281e7a4
-
SHA1
0a0c13ec0441ffb4c3f791cc48917efc3477d37f
-
SHA256
529a66b8d66850a28d401cc8dd77681335c39f1f0f4835a1701f3acab84836aa
-
SHA512
656ae787f908845bbca7f222583b79e43435f72d156678dff6fd94f122b06afaf3faf848f8ec1d0d87aa3aabd74c92b4d0ae43f82eae210a9cc5ae9739dc7df1
-
SSDEEP
768:2E7RUeILeOWS9st/XtDe3huf484Eu9HyClEB904/m82ojQ+yGdf:aeVtFDIRXE9d/mKM+yGZ
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" win32up.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6EJRS5-0SHXYH-OBO815-H12OR2} ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6EJRS5-0SHXYH-OBO815-H12OR2}\StubPath = "C:\\Windows\\system32\\win32up.exe" ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6EJRS5-0SHXYH-OBO815-H12OR2}\StubPath = "C:\\Windows\\system32\\win32up.exe" win32up.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" win32up.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win32up.exe ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win32up.exe win32up.exe -
Executes dropped EXE 1 IoCs
pid Process 1988 win32up.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update Service = "C:\\Windows\\system32\\win32up.exe" ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update Service = "C:\\Windows\\system32\\win32up.exe" win32up.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA win32up.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" win32up.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\win32up.exe ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe File opened for modification C:\Windows\system32\win32up.exe ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\LimeWire\Shared\Adobe Photoshop Lightroom v3.0 Build 677000 + Serials.exe win32up.exe File created C:\Program Files\emule\incoming\Windows 7 Loader v1.8.3-DAZ~DiBYA.exe win32up.exe File created C:\Program Files\morpheus\my shared folder\Photo.Art.Studio.v2.65-ViLLAiN.exe win32up.exe File created C:\Program Files\tesla\files\Windows 7 Loader eXtreme Edition v3.503-NAPALUM~DiBYA.exe win32up.exe File created C:\Program Files\winmx\shared\Windows 7 Loader eXtreme Edition v3.503-NAPALUM~DiBYA.exe win32up.exe File created C:\Program Files\eDonkey2000\incoming\WinCatalog Standard 1.094 build 04.05 [Darkman].exe win32up.exe File created C:\Program Files\kazaa lite\my shared folder\Adobe Photoshop Lightroom v3.0 Build 677000 + Serials.exe win32up.exe File created C:\Program Files\grokster\my grokster\iTunes 9.2 beta (use w\ 4.0 GM devices) _diMi.exe win32up.exe File created C:\Program Files\morpheus\my shared folder\UltraISO Premium Edition 9.3.6.2750 Retail.exe win32up.exe File created C:\Program Files\tesla\files\UltraISO Premium Edition 9.3.6.2750 Retail.exe win32up.exe File created C:\Program Files\tesla\files\[64-bit] WinRAR 3.93 ENG + Key TESTED.exe win32up.exe File created C:\Program Files\winmx\shared\Windows 7 Loader v1.8.3-DAZ~DiBYA.exe win32up.exe File created C:\Program Files\winmx\shared\AnyDVD.HD.6.6.5.5.Beta-M0RE.rar.exe win32up.exe File created C:\Program Files\eDonkey2000\incoming\Corel VideoStudio Pro X3 v13.6.2.36 + Keygen by AGAiN [RH].exe win32up.exe File created C:\Program Files\kazaa\my shared folder\Malwarebytes Anti Malware 1.46 Full +Serials [UT].exe win32up.exe File created C:\Program Files\kazaa lite\my shared folder\[64-bit] WinRAR 3.93 ENG + Key TESTED.exe win32up.exe File created C:\Program Files\morpheus\my shared folder\Windows 7 Loader v1.8.3-DAZ~DiBYA.exe win32up.exe File created C:\Program Files\morpheus\my shared folder\Adobe Photoshop Lightroom v3.0 Build 677000 + Serials.exe win32up.exe File created C:\Program Files\LimeWire\Shared\[64-bit] WinRAR 3.93 ENG + Key TESTED.exe win32up.exe File created C:\Program Files\eDonkey2000\incoming\Windows 7 Loader eXtreme Edition v3.503-NAPALUM~DiBYA.exe win32up.exe File created C:\Program Files\grokster\my grokster\Photo.Art.Studio.v2.65-ViLLAiN.exe win32up.exe File created C:\Program Files\emule\incoming\Adobe Photoshop Lightroom v3.0 Build 677000 + Serials.exe win32up.exe File created C:\Program Files\morpheus\my shared folder\CloneDVD v5.0.1.6 + patch.exe win32up.exe File created C:\Program Files\tesla\files\iTunes 9.2 beta (use w\ 4.0 GM devices) _diMi.exe win32up.exe File created C:\Program Files\winmx\shared\[64-bit] WinRAR 3.93 ENG + Key TESTED.exe win32up.exe File created C:\Program Files\winmx\shared\Corel VideoStudio Pro X3 v13.6.2.36 + Keygen by AGAiN [RH].exe win32up.exe File created C:\Program Files\kazaa\my shared folder\WinZip Pro.14.5 (Build 9095) + Serials [UT].exe win32up.exe File created C:\Program Files\grokster\my grokster\Corel VideoStudio Pro X3 v13.6.2.36 + Keygen by AGAiN [RH].exe win32up.exe File created C:\Program Files\emule\incoming\Malwarebytes Anti Malware 1.46 Full +Serials [UT].exe win32up.exe File created C:\Program Files\emule\incoming\CyberLink.PowerDVD.Ultra.3D.10.0.1705.51.exe win32up.exe File created C:\Program Files\tesla\files\Windows 7 Loader v1.8.3-DAZ~DiBYA.exe win32up.exe File created C:\Program Files\eDonkey2000\incoming\Battery.Optimizer.3.0.3.5-MKDEV.TEAM.exe win32up.exe File created C:\Program Files\kazaa lite\my shared folder\Malwarebytes Anti Malware 1.46 Full +Serials [UT].exe win32up.exe File created C:\Program Files\kazaa lite\my shared folder\Windows 7 Loader v1.8.3-DAZ~DiBYA.exe win32up.exe File created C:\Program Files\emule\incoming\WinCatalog Standard 1.094 build 04.05 [Darkman].exe win32up.exe File created C:\Program Files\emule\incoming\UltraISO Premium Edition 9.3.6.2750 Retail.exe win32up.exe File created C:\Program Files\morpheus\my shared folder\iTunes 9.2 beta (use w\ 4.0 GM devices) _diMi.exe win32up.exe File created C:\Program Files\LimeWire\Shared\CyberLink.PowerDVD.Ultra.3D.10.0.1705.51.exe win32up.exe File created C:\Program Files\eDonkey2000\incoming\CloneDVD v5.0.1.6 + patch.exe win32up.exe File created C:\Program Files\kazaa lite\my shared folder\CloneDVD v5.0.1.6 + patch.exe win32up.exe File created C:\Program Files\emule\incoming\CloneDVD v5.0.1.6 + patch.exe win32up.exe File created C:\Program Files\tesla\files\WinCatalog Standard 1.094 build 04.05 [Darkman].exe win32up.exe File created C:\Program Files\LimeWire\Shared\UltraISO Premium Edition 9.3.6.2750 Retail.exe win32up.exe File created C:\Program Files\kazaa lite\my shared folder\AnyDVD.HD.6.6.5.5.Beta-M0RE.rar.exe win32up.exe File created C:\Program Files\kazaa lite k++\my shared folder\UltraISO Premium Edition 9.3.6.2750 Retail.exe win32up.exe File created C:\Program Files\grokster\my grokster\CyberLink.PowerDVD.Ultra.3D.10.0.1705.51.exe win32up.exe File created C:\Program Files\emule\incoming\Windows 7 Loader eXtreme Edition v3.503-NAPALUM~DiBYA.exe win32up.exe File created C:\Program Files\eDonkey2000\incoming\EximiousSoft.Logo.Designer.2.38-MKDEV.TEAM.exe win32up.exe File created C:\Program Files\kazaa lite k++\my shared folder\CyberLink.PowerDVD.Ultra.3D.10.0.1705.51.exe win32up.exe File created C:\Program Files\tesla\files\EximiousSoft.Logo.Designer.2.38-MKDEV.TEAM.exe win32up.exe File created C:\Program Files\winmx\shared\UltraISO Premium Edition 9.3.6.2750 Retail.exe win32up.exe File created C:\Program Files\kazaa lite\my shared folder\Battery.Optimizer.3.0.3.5-MKDEV.TEAM.exe win32up.exe File created C:\Program Files\kazaa lite k++\my shared folder\iTunes 9.2 beta (use w\ 4.0 GM devices) _diMi.exe win32up.exe File created C:\Program Files\tesla\files\AnyDVD.HD.6.6.5.5.Beta-M0RE.rar.exe win32up.exe File created C:\Program Files\winmx\shared\WinZip Pro.14.5 (Build 9095) + Serials [UT].exe win32up.exe File created C:\Program Files\winmx\shared\Malwarebytes Anti Malware 1.46 Full +Serials [UT].exe win32up.exe File created C:\Program Files\LimeWire\Shared\Malwarebytes Anti Malware 1.46 Full +Serials [UT].exe win32up.exe File created C:\Program Files\LimeWire\Shared\Photo.Art.Studio.v2.65-ViLLAiN.exe win32up.exe File created C:\Program Files\eDonkey2000\incoming\UltraISO Premium Edition 9.3.6.2750 Retail.exe win32up.exe File created C:\Program Files\kazaa lite k++\my shared folder\CloneDVD v5.0.1.6 + patch.exe win32up.exe File created C:\Program Files\kazaa\my shared folder\CloneDVD v5.0.1.6 + patch.exe win32up.exe File created C:\Program Files\grokster\my grokster\Windows 7 Loader eXtreme Edition v3.503-NAPALUM~DiBYA.exe win32up.exe File created C:\Program Files\emule\incoming\[64-bit] WinRAR 3.93 ENG + Key TESTED.exe win32up.exe File created C:\Program Files\morpheus\my shared folder\[64-bit] WinRAR 3.93 ENG + Key TESTED.exe win32up.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 win32up.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier win32up.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 836 ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe 836 ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe 836 ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe 836 ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe 836 ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe 836 ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe 836 ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe 1988 win32up.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 836 ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe Token: SeDebugPrivilege 1988 win32up.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 836 wrote to memory of 1988 836 ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe 88 PID 836 wrote to memory of 1988 836 ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe 88 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" win32up.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" win32up.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\system32\win32up.exe"C:\Windows\system32\win32up.exe"2⤵
- UAC bypass
- Boot or Logon Autostart Execution: Active Setup
- Disables RegEdit via registry modification
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5ac5b74bde9b37320fd66c2f25281e7a4
SHA10a0c13ec0441ffb4c3f791cc48917efc3477d37f
SHA256529a66b8d66850a28d401cc8dd77681335c39f1f0f4835a1701f3acab84836aa
SHA512656ae787f908845bbca7f222583b79e43435f72d156678dff6fd94f122b06afaf3faf848f8ec1d0d87aa3aabd74c92b4d0ae43f82eae210a9cc5ae9739dc7df1