Analysis
-
max time kernel
92s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe
-
Size
525KB
-
MD5
eed44fafaced1aefc3d7cd6a047eae93
-
SHA1
6962c94d3fd65fbf93c699013a5aeaa62fdb948c
-
SHA256
64f909766ea261e3a72d0129038d4694fdcf7688ddc76257174a6fb5631e15c6
-
SHA512
7da20412dbd4c528516bb5f42299e3bdbc8ef540d00985d12026ffedca2a62b05c4208ba383a5f1ea0b483a53f96f1b8d1c4141449b3692973e3a863c505d30b
-
SSDEEP
12288:PoEVRgpaAcKBansAV30bzDWNkbk9ekPd6UTx8y:gEVKbBcV2zDWybkxYUTmy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515} svcr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515}\StubPath = "C:\\windows\\svcr.exe" svcr.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 2504 svcr.exe -
Executes dropped EXE 1 IoCs
pid Process 2504 svcr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\svcr.exe" eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\svcr.exe" eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\svcr.exe eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe File created C:\Windows\svcr.exe eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svcr.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tl2010332784q.vpc eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\tl2010332784q.vpc\ = 17531834d05483f7cd05587aa98dc2518a1b0e4b79ad5bc7 eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tl2010332784q.vpc svcr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\tl2010332784q.vpc\ = 17531834d05483f7cd05587aa98dc2518a1b0e4b79ad5bc7 svcr.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1808 eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe 1808 eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe 2504 svcr.exe 2504 svcr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2504 svcr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1808 wrote to memory of 2504 1808 eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe 83 PID 1808 wrote to memory of 2504 1808 eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe 83 PID 1808 wrote to memory of 2504 1808 eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe 83 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54 PID 2504 wrote to memory of 3420 2504 svcr.exe 54
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\svcr.exe"C:\Windows\svcr.exe" "C:\Users\Admin\AppData\Local\Temp\eed44fafaced1aefc3d7cd6a047eae93_JaffaCakes118.exe"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-656926755-4116854191-210765258-1000\549b9b645cadfe6bb4bc69cf363c354c_6f95b8b4-c02b-43c9-8cd4-016780936b63
Filesize2KB
MD5f97f9e17eafdd0105a4e11bafde04b40
SHA1ba06a7abe986a61b71889b80a6f9b02b22d40667
SHA2564783424121e6c2f870dc931b374d20c62c764eddc5769d2f536609adc1226abb
SHA512778c4aab55f6f0fe44dbc9a97f53b59ec8ed2e35901f77afebaea57c738ad301412760709ab909b51335ddd7676cd8f8c1410c5751f2ef5cc74282bcd6c5f50e
-
Filesize
525KB
MD5eed44fafaced1aefc3d7cd6a047eae93
SHA16962c94d3fd65fbf93c699013a5aeaa62fdb948c
SHA25664f909766ea261e3a72d0129038d4694fdcf7688ddc76257174a6fb5631e15c6
SHA5127da20412dbd4c528516bb5f42299e3bdbc8ef540d00985d12026ffedca2a62b05c4208ba383a5f1ea0b483a53f96f1b8d1c4141449b3692973e3a863c505d30b