Analysis
-
max time kernel
140s -
max time network
88s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
14-09-2024 03:51
Static task
static1
Behavioral task
behavioral1
Sample
df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe
-
Size
278KB
-
MD5
df7004566bd1250ad7912571bbeb3d47
-
SHA1
7ecda9cdd006e84f48b0c6e9890a882127878d0d
-
SHA256
e441a984525d5fd2cd17bcb90bc4a9bd77469acee48fe800802e60c2c1529a28
-
SHA512
9478a75444bba9e35c58027c191fe75d242e968b5d9c4ee851d6bda075b73ed22f297c291726bac9c2682c8c4f92fcea134f378296a41ab5446065d81bad45ab
-
SSDEEP
6144:/bYJKT03oCUI8y+tTVB9pDtF4/hWYq8KG1t4qeiiw:/XoUI8PVLpDtGwYMxi/
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2392 3B8.tmp -
Loads dropped DLL 2 IoCs
pid Process 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/528-2-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/528-11-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/528-14-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/1332-15-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1332-17-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/528-77-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2356-79-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/528-196-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/528-200-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\0E0.exe = "C:\\Program Files (x86)\\LP\\61AE\\0E0.exe" df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\LP\61AE\0E0.exe df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\61AE\3B8.tmp df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe File created C:\Program Files (x86)\LP\61AE\0E0.exe df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B8.tmp -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2380 explorer.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeSecurityPrivilege 2852 msiexec.exe Token: SeShutdownPrivilege 2380 explorer.exe Token: SeShutdownPrivilege 2380 explorer.exe Token: SeShutdownPrivilege 2380 explorer.exe Token: SeShutdownPrivilege 2380 explorer.exe Token: SeShutdownPrivilege 2380 explorer.exe Token: SeShutdownPrivilege 2380 explorer.exe Token: SeShutdownPrivilege 2380 explorer.exe Token: SeShutdownPrivilege 2380 explorer.exe Token: SeShutdownPrivilege 2380 explorer.exe Token: SeShutdownPrivilege 2380 explorer.exe Token: 33 1920 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1920 AUDIODG.EXE Token: 33 1920 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1920 AUDIODG.EXE Token: SeShutdownPrivilege 2380 explorer.exe Token: SeShutdownPrivilege 2380 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe 2380 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 528 wrote to memory of 1332 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 31 PID 528 wrote to memory of 1332 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 31 PID 528 wrote to memory of 1332 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 31 PID 528 wrote to memory of 1332 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 31 PID 528 wrote to memory of 2356 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 33 PID 528 wrote to memory of 2356 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 33 PID 528 wrote to memory of 2356 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 33 PID 528 wrote to memory of 2356 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 33 PID 528 wrote to memory of 2392 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 37 PID 528 wrote to memory of 2392 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 37 PID 528 wrote to memory of 2392 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 37 PID 528 wrote to memory of 2392 528 df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe 37 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:528 -
C:\Users\Admin\AppData\Local\Temp\df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\E9991\5FA61.exe%C:\Users\Admin\AppData\Roaming\E99912⤵
- System Location Discovery: System Language Discovery
PID:1332
-
-
C:\Users\Admin\AppData\Local\Temp\df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe startC:\Program Files (x86)\91195\lvvm.exe%C:\Program Files (x86)\911952⤵
- System Location Discovery: System Language Discovery
PID:2356
-
-
C:\Program Files (x86)\LP\61AE\3B8.tmp"C:\Program Files (x86)\LP\61AE\3B8.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2392
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2380
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5d41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1920
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cfff7c862892e7a5f00f1bcda5b5f599
SHA194cfd392aecfe9cca63851e9a0a6490f86ece641
SHA2568f5754490c5863b53a4d4529aca00cfd96552410893a9d524719041244d858f5
SHA5122bfcdc5db4266204d85b3b91a2a98c04e956ca723702d2d31858c4efaee3d167262e4e32f49826e21d9368cdb5d2a438011e46a87c30acd74854b9013a96a5df
-
Filesize
600B
MD51789ddbb70ce8beb8cf1b86665d984d8
SHA1cc0d129198cc81d53ca87a0f5318e915529114b5
SHA2563081b9d351710cf0e8df5c3c6e379df55ed475ba1d2bb26d22475d90497bd05b
SHA5126a36261098f9edab1306c330da417cb9060fa12372e64b5e15d60d904106d98f32d36d8075d0b79e6720023abce0f02afe643303c918462f91b5e9d854c9cb4f
-
Filesize
996B
MD5f8cbc9d019fb4f5224cf1e1f85e80a44
SHA1da94af6ede382ef8fda6a7908ea1d51abc927d4d
SHA256c3b62d394c5d78051f09fe75bda93f2bc704fac38df45e5188121149576bf6b4
SHA51208404c9f89719dd58c1855b34717cf7e291e9f564fd8597ceac7fb3208d644b5b17e6e4f74d40cf0010bf621f30bdb3725d304a0e593452860c9f9e7076e3a13
-
Filesize
99KB
MD5b6c44c70136fcbed1aace964c4e98e9d
SHA14f7961087e09cdf03efe4fe0b7f2243499504628
SHA25675d10ab1bea3e7cb80e3c0048b79cf0496c88b885ff853d6f430c71272030bcd
SHA512801762bbc8ffa62fd49dadb75bfa0ff31f73ee4b712c91d23885f0d4fbc45eebbc30f2ab84e04ce375e8a269bb2a1c8514c4dd9cbd50f42e5960987c719092da