Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe
-
Size
525KB
-
MD5
eed44fafaced1aefc3d7cd6a047eae93
-
SHA1
6962c94d3fd65fbf93c699013a5aeaa62fdb948c
-
SHA256
64f909766ea261e3a72d0129038d4694fdcf7688ddc76257174a6fb5631e15c6
-
SHA512
7da20412dbd4c528516bb5f42299e3bdbc8ef540d00985d12026ffedca2a62b05c4208ba383a5f1ea0b483a53f96f1b8d1c4141449b3692973e3a863c505d30b
-
SSDEEP
12288:PoEVRgpaAcKBansAV30bzDWNkbk9ekPd6UTx8y:gEVKbBcV2zDWybkxYUTmy
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515} svcr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515}\StubPath = "C:\\windows\\svcr.exe" svcr.exe -
Deletes itself 1 IoCs
pid Process 2800 svcr.exe -
Executes dropped EXE 1 IoCs
pid Process 2800 svcr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\svcr.exe" eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\svcr.exe" eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\svcr.exe eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe File created C:\Windows\svcr.exe eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svcr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tl2010332784q.vpc eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\tl2010332784q.vpc\ = 17531834d05483f7cd05587aa98dc251133f224b79ad5bc7 eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tl2010332784q.vpc svcr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\tl2010332784q.vpc\ = 17531834d05483f7cd05587aa98dc251133f224b79ad5bc7 svcr.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2984 eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe 2800 svcr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2800 svcr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2800 2984 eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe 30 PID 2984 wrote to memory of 2800 2984 eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe 30 PID 2984 wrote to memory of 2800 2984 eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe 30 PID 2984 wrote to memory of 2800 2984 eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe 30 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21 PID 2800 wrote to memory of 1264 2800 svcr.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\svcr.exe"C:\Windows\svcr.exe" "C:\Users\Admin\AppData\Local\Temp\eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
525KB
MD5eed44fafaced1aefc3d7cd6a047eae93
SHA16962c94d3fd65fbf93c699013a5aeaa62fdb948c
SHA25664f909766ea261e3a72d0129038d4694fdcf7688ddc76257174a6fb5631e15c6
SHA5127da20412dbd4c528516bb5f42299e3bdbc8ef540d00985d12026ffedca2a62b05c4208ba383a5f1ea0b483a53f96f1b8d1c4141449b3692973e3a863c505d30b