Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2024 23:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
General
-
Target
d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe
-
Size
708KB
-
MD5
d5513a0a81fffd02cea80e0cd18cd1ce
-
SHA1
6e5fdb29355c0cbbe5a3c9749fa1cc5973447f6e
-
SHA256
d1eff42befabb59f568bb8647f29c32e54b9fb55bdd4d33d658df46a98575b74
-
SHA512
330392b9a9ffbdc41e79e16cfd3a8d4e902a7f6dc6b967de03fca63201898fcf20686271e6c2f4eae9ede66d3a2ce14cdee2c40e1342a641ecec16e5ea72a7d3
-
SSDEEP
6144:3A3BKBqCW/CW68Qm1Qeme003yfVj0Xu+vzpBeiBkcpEMYWwl4GwqkyRi75YNq:3AxKBcGejyfVqvNgYFbwVkyRi75YE
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe:*:Enabled:@xpsp2res.dll,-22019" d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/4456-2797-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2799-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2800-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2801-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2802-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2803-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2806-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2805-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2804-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2809-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2810-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2812-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2811-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2813-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2814-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2815-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2816-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2817-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2818-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2819-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2820-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2821-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2822-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2823-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2824-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-2825-0x0000000000400000-0x00000000004C9000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msnmsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe" d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msnmsgm d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2592 set thread context of 8896 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 86 PID 8896 set thread context of 4456 8896 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 8896 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeSecurityPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeSystemtimePrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeBackupPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeRestorePrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeShutdownPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeDebugPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeUndockPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeManageVolumePrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeImpersonatePrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: 33 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: 34 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: 35 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe Token: 36 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 8896 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 4456 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2592 wrote to memory of 8896 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 86 PID 2592 wrote to memory of 8896 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 86 PID 2592 wrote to memory of 8896 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 86 PID 2592 wrote to memory of 8896 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 86 PID 2592 wrote to memory of 8896 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 86 PID 2592 wrote to memory of 8896 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 86 PID 2592 wrote to memory of 8896 2592 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 86 PID 8896 wrote to memory of 4456 8896 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 87 PID 8896 wrote to memory of 4456 8896 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 87 PID 8896 wrote to memory of 4456 8896 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 87 PID 8896 wrote to memory of 4456 8896 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 87 PID 8896 wrote to memory of 4456 8896 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 87 PID 8896 wrote to memory of 4456 8896 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 87 PID 8896 wrote to memory of 4456 8896 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 87 PID 8896 wrote to memory of 4456 8896 d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe2⤵
- Modifies firewall policy service
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8896 -
C:\Users\Admin\AppData\Local\Temp\d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d5513a0a81fffd02cea80e0cd18cd1ce_JaffaCakes118.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4456
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1