Analysis

  • max time kernel
    127s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2024 05:14

General

  • Target

    ef217f8585aeea8a01f80979596cc651_JaffaCakes118.exe

  • Size

    414KB

  • MD5

    ef217f8585aeea8a01f80979596cc651

  • SHA1

    ae36313f02ecd0d15a15ece2f96d81c46f8b39b6

  • SHA256

    d197713fb9bc979ad38a9d9d1435ae1abe3cb1cf5492e592c27e5a4d9dcedac1

  • SHA512

    566836da7f0d2c7c01ffeebff0311e288db1e2363779bfd22851e1a4e5198a97abae9b4fce7ad5885787dc75c288c2c11c402f8a9884281b56d2c38d2cb00d75

  • SSDEEP

    12288:hEU3npqLuOCtLpq7vnGjp2Vofyr3t/Fwh0uZatfGRxSI:hEU3pqLXEUQ2VofyxFwh0N

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 23 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef217f8585aeea8a01f80979596cc651_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ef217f8585aeea8a01f80979596cc651_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4176
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 888
      2⤵
      • Program crash
      PID:3356
    • C:\ProgramData\gK28611LeDpK28611\gK28611LeDpK28611.exe
      "C:\ProgramData\gK28611LeDpK28611\gK28611LeDpK28611.exe" "C:\Users\Admin\AppData\Local\Temp\ef217f8585aeea8a01f80979596cc651_JaffaCakes118.exe"
      2⤵
      • Modifies security service
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2576
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 888
        3⤵
        • Program crash
        PID:2680
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4176 -ip 4176
    1⤵
      PID:652
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2576 -ip 2576
      1⤵
        PID:3500
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:4604
      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:4076
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1744
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1044
      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:4128
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
          PID:3052
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of FindShellTrayWindow
          PID:2316
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2992
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:4180
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            PID:1500
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2892
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:1656
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2444
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2504
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2840
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:4740
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            • Suspicious use of FindShellTrayWindow
            PID:2776
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:1752
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:2720
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:1020
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:1528
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:3456
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:4412
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:3524
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:4580
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:3020
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:3804
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:3184
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:1152
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:2472
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:4416
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:1548
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:776
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4944
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:1768
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:2740
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:1576
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:4200
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3852
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:2384
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3540
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4580
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:1648
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:2508
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4340
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:1660
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2764
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4416
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:408
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:804
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3896
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3796
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3716
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3508
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:676
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:860
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4128
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:400

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\ProgramData\gK28611LeDpK28611\gK28611LeDpK28611.exe

                                                                  Filesize

                                                                  414KB

                                                                  MD5

                                                                  6ac576249ef7cd11a3cf072495046911

                                                                  SHA1

                                                                  d881c9e045eaf28e713e4aefa786f6ea9e334ae0

                                                                  SHA256

                                                                  5f1833fe10766ce2f26baf3a03dfeaa9277efd0b742b0a0d4a4be4c5d80295d5

                                                                  SHA512

                                                                  66aa9ed04a1ae64978bf75676493858f2a1e60a99ba513c53e996befe9feee68894c55a3f4b808a0a579fb4379f5561770b3b12823d796007462f92fcd5a8028

                                                                • memory/2576-21-0x0000000000400000-0x00000000004D2000-memory.dmp

                                                                  Filesize

                                                                  840KB

                                                                • memory/2576-22-0x0000000000400000-0x00000000004D2000-memory.dmp

                                                                  Filesize

                                                                  840KB

                                                                • memory/2576-28-0x0000000000400000-0x00000000004D2000-memory.dmp

                                                                  Filesize

                                                                  840KB

                                                                • memory/2576-36-0x0000000000400000-0x00000000004D2000-memory.dmp

                                                                  Filesize

                                                                  840KB

                                                                • memory/2576-37-0x0000000000400000-0x00000000004D2000-memory.dmp

                                                                  Filesize

                                                                  840KB

                                                                • memory/2576-38-0x0000000000400000-0x00000000004D2000-memory.dmp

                                                                  Filesize

                                                                  840KB

                                                                • memory/2576-39-0x0000000000400000-0x00000000004D2000-memory.dmp

                                                                  Filesize

                                                                  840KB

                                                                • memory/4176-0-0x0000000002240000-0x0000000002243000-memory.dmp

                                                                  Filesize

                                                                  12KB

                                                                • memory/4176-1-0x0000000000400000-0x00000000004D2000-memory.dmp

                                                                  Filesize

                                                                  840KB

                                                                • memory/4176-10-0x0000000000400000-0x00000000004D2000-memory.dmp

                                                                  Filesize

                                                                  840KB

                                                                • memory/4176-19-0x0000000000400000-0x00000000004D2000-memory.dmp

                                                                  Filesize

                                                                  840KB