Analysis
-
max time kernel
140s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-09-2024 05:16
Static task
static1
Behavioral task
behavioral1
Sample
ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe
-
Size
283KB
-
MD5
ece8ea17672274ebb91f23e809cba376
-
SHA1
12309d46681bc163cb84a5c08d7e37cfaf15700e
-
SHA256
bab25fb93518089767fc3801778d9ed0be4ae634b535cf377bc7f4f791d252b9
-
SHA512
248d1533f4b4f33b9c06bc7d226d1d525a1f14220fe9ed5cc1a8163ad2f1b821c3b89c0a2fd1b82e330928006a7741ee6086f4026f69d3e601305b1e48da31a7
-
SSDEEP
6144:7yBlvQ6xuIO/taCnq0A8RPAAiwv1MSAAI0R/WPa3YdX9vHj4Si:2BlvrQIO/tS3Wiwv1MRAI0pWPaIBxDpi
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2188 5486.tmp -
Loads dropped DLL 2 IoCs
pid Process 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2092-2-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2092-11-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2092-12-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/1732-17-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2092-15-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2092-79-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/904-81-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2092-175-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2092-200-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2092-203-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\424.exe = "C:\\Program Files (x86)\\LP\\5E10\\424.exe" ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\LP\5E10\424.exe ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe File created C:\Program Files (x86)\LP\5E10\424.exe ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\5E10\5486.tmp ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5486.tmp -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2052 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 696 msiexec.exe Token: SeTakeOwnershipPrivilege 696 msiexec.exe Token: SeSecurityPrivilege 696 msiexec.exe Token: SeShutdownPrivilege 2052 explorer.exe Token: SeShutdownPrivilege 2052 explorer.exe Token: SeShutdownPrivilege 2052 explorer.exe Token: SeShutdownPrivilege 2052 explorer.exe Token: SeShutdownPrivilege 2052 explorer.exe Token: SeShutdownPrivilege 2052 explorer.exe Token: SeShutdownPrivilege 2052 explorer.exe Token: SeShutdownPrivilege 2052 explorer.exe Token: SeShutdownPrivilege 2052 explorer.exe Token: SeShutdownPrivilege 2052 explorer.exe Token: SeShutdownPrivilege 2052 explorer.exe Token: SeShutdownPrivilege 2052 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe 2052 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2092 wrote to memory of 1732 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 32 PID 2092 wrote to memory of 1732 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 32 PID 2092 wrote to memory of 1732 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 32 PID 2092 wrote to memory of 1732 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 32 PID 2092 wrote to memory of 904 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 34 PID 2092 wrote to memory of 904 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 34 PID 2092 wrote to memory of 904 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 34 PID 2092 wrote to memory of 904 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 34 PID 2092 wrote to memory of 2188 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 37 PID 2092 wrote to memory of 2188 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 37 PID 2092 wrote to memory of 2188 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 37 PID 2092 wrote to memory of 2188 2092 ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe 37 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\06428\AAF5E.exe%C:\Users\Admin\AppData\Roaming\064282⤵
- System Location Discovery: System Language Discovery
PID:1732
-
-
C:\Users\Admin\AppData\Local\Temp\ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ece8ea17672274ebb91f23e809cba376_JaffaCakes118.exe startC:\Program Files (x86)\2862E\lvvm.exe%C:\Program Files (x86)\2862E2⤵
- System Location Discovery: System Language Discovery
PID:904
-
-
C:\Program Files (x86)\LP\5E10\5486.tmp"C:\Program Files (x86)\LP\5E10\5486.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:696
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2052
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5df3795dfc667957fd0c52e445d384371
SHA14c50e70936b1f7e76a74e0ae90119552c247bf0a
SHA2569c8928fd79a9f323036bf0e92ee9c7accae2d2fe826ab39ec156d36fd11b11e6
SHA5121d1742e6edcef87e06883d693dc4eff7f71f6cf7a81688f53baf51c54828a942c812a6047bab53ddb0bef4b7750444950f27c6492baee46c0e9691fc1f6cace5
-
Filesize
600B
MD533a975ff8ee5e1d30d475b54e8c708d2
SHA185c31dfe9a680454113b9da8cc6413b98e8314da
SHA2568a84d267e29c0481024a6bc70819b165f7c452b212b1295151c17a9492c665a5
SHA51277f0e93f109a96755c81e9bfcfe1377537981d8e6edd529122e3dc80e99018ec9db65ad22f3a6ed89ed71c73a927eb6171691fd399d892771506961d1c2564ff
-
Filesize
996B
MD568587bdf1b8c21ad91afff52595dd22f
SHA17aff1085554045642bbf3b99d2e29d3f1e9b36f1
SHA25669a5e56acaa21893b15ca789cf445ad75c01e98b11be156e666dea62ac1da78c
SHA5127d54714d99fa7b884086fa65f9579dc78d0808b11047568a64bde5a223ec664912949ed8daa379088cce833ed19361c66c606ebfce982fbe263e4a1fe58ad372
-
Filesize
300B
MD562009de4ad5395441ccaa9c77760c9b2
SHA11f317e217f6d0cc93bbc5dfb744b9c88955f6e64
SHA2561f1c5f52f1952dede408149a676f2710bf537d1a240d08ac8d4933b238a95aaf
SHA512e9dde8a68abce6ff5177f0ea8999fc01e747da6e6c38a940a283754041cdbf243a3151744ef7d61a6627ceb96eca002ed8f1beca79e19eae0f1191ae643a5c90
-
Filesize
99KB
MD5f2a253e558976d2d90c49d5154ffe1b8
SHA1527acecd863143b49546317bb4611fea134b442b
SHA256d8420ed0c4c492a51f9c7906d590002de6ec86c4b10dad22c33272615a658d84
SHA5120053d0d2169d10a287f2d01ee6d9b3a4182d5f97ef58cdb3fd66d865c6969df1b0a7b72e3be3b2892aaa9b2ec18152f43216b4da9d2b71142fb2cd737e4db88a