Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe
-
Size
836KB
-
MD5
eab9317a8b202c132c78322aa06d798f
-
SHA1
57fd3808f9669a9c73a25b4fb7e20b18069e02ed
-
SHA256
fe7fea0f5adc8bf465ce6cfc42be84e7d89573b591e885482d6c17ae0d9ac8e2
-
SHA512
eb189ef350dc530a5f87dc6cf8ddb955969b101a386737eec441ce59c400e030cc62b9b0f0bfe064c8ae7ca0de692a4a3257772b4b398c933a64c4295b077b3b
-
SSDEEP
12288:hINizheL8lCSm4ifvE/NAxukDqihzVT/DiKD:hD8LMDcvE/oDJVjDiE
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2808 msdcsc.exe -
Loads dropped DLL 2 IoCs
pid Process 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2808 set thread context of 2588 2808 msdcsc.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeSecurityPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeSystemtimePrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeBackupPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeRestorePrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeShutdownPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeDebugPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeUndockPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeManageVolumePrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeImpersonatePrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: 33 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: 34 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: 35 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2808 msdcsc.exe Token: SeSecurityPrivilege 2808 msdcsc.exe Token: SeTakeOwnershipPrivilege 2808 msdcsc.exe Token: SeLoadDriverPrivilege 2808 msdcsc.exe Token: SeSystemProfilePrivilege 2808 msdcsc.exe Token: SeSystemtimePrivilege 2808 msdcsc.exe Token: SeProfSingleProcessPrivilege 2808 msdcsc.exe Token: SeIncBasePriorityPrivilege 2808 msdcsc.exe Token: SeCreatePagefilePrivilege 2808 msdcsc.exe Token: SeBackupPrivilege 2808 msdcsc.exe Token: SeRestorePrivilege 2808 msdcsc.exe Token: SeShutdownPrivilege 2808 msdcsc.exe Token: SeDebugPrivilege 2808 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2808 msdcsc.exe Token: SeChangeNotifyPrivilege 2808 msdcsc.exe Token: SeRemoteShutdownPrivilege 2808 msdcsc.exe Token: SeUndockPrivilege 2808 msdcsc.exe Token: SeManageVolumePrivilege 2808 msdcsc.exe Token: SeImpersonatePrivilege 2808 msdcsc.exe Token: SeCreateGlobalPrivilege 2808 msdcsc.exe Token: 33 2808 msdcsc.exe Token: 34 2808 msdcsc.exe Token: 35 2808 msdcsc.exe Token: SeIncreaseQuotaPrivilege 2588 iexplore.exe Token: SeSecurityPrivilege 2588 iexplore.exe Token: SeTakeOwnershipPrivilege 2588 iexplore.exe Token: SeLoadDriverPrivilege 2588 iexplore.exe Token: SeSystemProfilePrivilege 2588 iexplore.exe Token: SeSystemtimePrivilege 2588 iexplore.exe Token: SeProfSingleProcessPrivilege 2588 iexplore.exe Token: SeIncBasePriorityPrivilege 2588 iexplore.exe Token: SeCreatePagefilePrivilege 2588 iexplore.exe Token: SeBackupPrivilege 2588 iexplore.exe Token: SeRestorePrivilege 2588 iexplore.exe Token: SeShutdownPrivilege 2588 iexplore.exe Token: SeDebugPrivilege 2588 iexplore.exe Token: SeSystemEnvironmentPrivilege 2588 iexplore.exe Token: SeChangeNotifyPrivilege 2588 iexplore.exe Token: SeRemoteShutdownPrivilege 2588 iexplore.exe Token: SeUndockPrivilege 2588 iexplore.exe Token: SeManageVolumePrivilege 2588 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2588 iexplore.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2808 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe 31 PID 2268 wrote to memory of 2808 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe 31 PID 2268 wrote to memory of 2808 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe 31 PID 2268 wrote to memory of 2808 2268 eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe 31 PID 2808 wrote to memory of 2588 2808 msdcsc.exe 32 PID 2808 wrote to memory of 2588 2808 msdcsc.exe 32 PID 2808 wrote to memory of 2588 2808 msdcsc.exe 32 PID 2808 wrote to memory of 2588 2808 msdcsc.exe 32 PID 2808 wrote to memory of 2588 2808 msdcsc.exe 32 PID 2808 wrote to memory of 2588 2808 msdcsc.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eab9317a8b202c132c78322aa06d798f_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
836KB
MD5eab9317a8b202c132c78322aa06d798f
SHA157fd3808f9669a9c73a25b4fb7e20b18069e02ed
SHA256fe7fea0f5adc8bf465ce6cfc42be84e7d89573b591e885482d6c17ae0d9ac8e2
SHA512eb189ef350dc530a5f87dc6cf8ddb955969b101a386737eec441ce59c400e030cc62b9b0f0bfe064c8ae7ca0de692a4a3257772b4b398c933a64c4295b077b3b