Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe
-
Size
457KB
-
MD5
c081f6c1e7f47df99c84033bfc3b1b7d
-
SHA1
d0e18725c64e13ad26dfa7900fe67fbb1ff6327b
-
SHA256
de56748561bdd30b47f0a64e4bbe0226771f428b1c5a793aeb109d248c672417
-
SHA512
e3df5333233671c75ddfd7d21da345a3158038ff5786d9461b0ab28a1b5ad1eb353bc02b8650d5b7d6934b7a7443dc12078da948aa4bd5586acf4a61e5f6dd98
-
SSDEEP
6144:eiiA/aDa4zZk1KQ01j7R7hnjlEpYofsF+B8TNoIPDQN4gKRfUW/h08hExcBQOLdu:eSaDpWKT7xhn7TNo2A4gScW/h0jx6Q6Y
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" services.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 2096 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1304 fservice.exe 2876 services.exe -
Loads dropped DLL 4 IoCs
pid Process 2552 c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe 2552 c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe 2876 services.exe 2876 services.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ services.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\fservice.exe c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fservice.exe c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe File created C:\Windows\SysWOW64\fservice.exe fservice.exe File opened for modification C:\Windows\SysWOW64\fservice.exe fservice.exe File created C:\Windows\SysWOW64\winkey.dll services.exe File created C:\Windows\SysWOW64\reginv.dll services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\system\sservice.exe services.exe File opened for modification C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe File opened for modification C:\Windows\system\sservice.exe c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe File created C:\Windows\services.exe fservice.exe File opened for modification C:\Windows\services.exe fservice.exe File created C:\Windows\system\sservice.exe fservice.exe File opened for modification C:\Windows\system\sservice.exe fservice.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe 2876 services.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2876 services.exe 2876 services.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2552 wrote to memory of 1304 2552 c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe 29 PID 2552 wrote to memory of 1304 2552 c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe 29 PID 2552 wrote to memory of 1304 2552 c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe 29 PID 2552 wrote to memory of 1304 2552 c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe 29 PID 2552 wrote to memory of 2096 2552 c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe 30 PID 2552 wrote to memory of 2096 2552 c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe 30 PID 2552 wrote to memory of 2096 2552 c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe 30 PID 2552 wrote to memory of 2096 2552 c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe 30 PID 1304 wrote to memory of 2876 1304 fservice.exe 32 PID 1304 wrote to memory of 2876 1304 fservice.exe 32 PID 1304 wrote to memory of 2876 1304 fservice.exe 32 PID 1304 wrote to memory of 2876 1304 fservice.exe 32 PID 2876 wrote to memory of 2664 2876 services.exe 33 PID 2876 wrote to memory of 2664 2876 services.exe 33 PID 2876 wrote to memory of 2664 2876 services.exe 33 PID 2876 wrote to memory of 2664 2876 services.exe 33 PID 2876 wrote to memory of 2716 2876 services.exe 34 PID 2876 wrote to memory of 2716 2876 services.exe 34 PID 2876 wrote to memory of 2716 2876 services.exe 34 PID 2876 wrote to memory of 2716 2876 services.exe 34 PID 2716 wrote to memory of 2688 2716 NET.exe 37 PID 2716 wrote to memory of 2688 2716 NET.exe 37 PID 2716 wrote to memory of 2688 2716 NET.exe 37 PID 2716 wrote to memory of 2688 2716 NET.exe 37 PID 2664 wrote to memory of 2740 2664 NET.exe 38 PID 2664 wrote to memory of 2740 2664 NET.exe 38 PID 2664 wrote to memory of 2740 2664 NET.exe 38 PID 2664 wrote to memory of 2740 2664 NET.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\fservice.exeC:\Windows\system32\fservice.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\services.exeC:\Windows\services.exe -XP3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\NET.exeNET STOP srservice4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP srservice5⤵
- System Location Discovery: System Language Discovery
PID:2740
-
-
-
C:\Windows\SysWOW64\NET.exeNET STOP navapsvc4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP navapsvc5⤵
- System Location Discovery: System Language Discovery
PID:2688
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2096
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133B
MD57db595f27577f5043312abd397c9356e
SHA16e13f1e8ca4d5b01c11173e1aec5682e9d44872f
SHA25684e10183a6c65ecf204100a02265823b218ee3c9dd7d9f5c301e71888ba4e61a
SHA51200e0582350e77dd63cf0184faa5c7313ba565298df0fba6a821568a8acc1919211c702ff3bd773705ffbf2dfcfe7201deb5f1850021b6b68b64ea32ce437a469
-
Filesize
457KB
MD5c081f6c1e7f47df99c84033bfc3b1b7d
SHA1d0e18725c64e13ad26dfa7900fe67fbb1ff6327b
SHA256de56748561bdd30b47f0a64e4bbe0226771f428b1c5a793aeb109d248c672417
SHA512e3df5333233671c75ddfd7d21da345a3158038ff5786d9461b0ab28a1b5ad1eb353bc02b8650d5b7d6934b7a7443dc12078da948aa4bd5586acf4a61e5f6dd98
-
Filesize
36KB
MD5d4a3f90e159ffbcbc4f9740de4b7f171
SHA10542f5d1e2c23dca8d90766b3a8537dc3880e5c9
SHA2562200dd5f83d2fb8c5d3994206a4fa9ff34b4cbfe56ed39a9a03c954cf45d8f77
SHA5125493beb50b5f7d8ec52f32718d01696916ae173456005d0c1294ce695161ce5004aff58ee3892bf5db0f9b23720146a6d3ae8ffbcbbd81f84d894fdc8cf75a94
-
Filesize
24KB
MD543e7d9b875c921ba6be38d45540fb9dd
SHA1f22a73fc0d4aa3ea6c0b8f61d974b028f308acc4
SHA256f1b2b0abe844e6ba812c7f8709a463a7f6c56fa6ac38d376a0739cc3469f795b
SHA5122e74e23c0875b69b82319391c392132f28f4eb45aa412805130382498ae48969a06a2b3a7528b626fa7d7ddb6b006f19f0ef8d73cf73cb9a0c0df44a21077622