Analysis
-
max time kernel
25s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-09-2024 19:38
Errors
General
-
Target
f2fc58b2df08d52f991cc204d1345ba2_JaffaCakes118.exe
-
Size
282KB
-
MD5
f2fc58b2df08d52f991cc204d1345ba2
-
SHA1
b15fa84e26511711eb7ee4076cd2768a43cf508a
-
SHA256
1c6eafc7acc4a53abb1f439ca12bbecea468fd13266b4f2ae0939feb949944ab
-
SHA512
b7f5c7bfa0074fc0f4a6d66b1c17773f6a2b035e991956b6dabc80c36e87faae506219cebff75eaa51df1fe4e72a4475769670fbef305247c43d152650fe8962
-
SSDEEP
6144:1YuUaYTcIuw4mPMZ50HFGgGfILJ/Zv/TGmUs+xkFrb+ANbsj:1JTB10w8L5F/TG/k59U
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 10 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2fc58b2df08d52f991cc204d1345ba2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2fc58b2df08d52f991cc204d1345ba2_JaffaCakes118.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f2fc58b2df08d52f991cc204d1345ba2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f2fc58b2df08d52f991cc204d1345ba2_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\C62F9\E5AD1.exe%C:\Users\Admin\AppData\Roaming\C62F92⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\f2fc58b2df08d52f991cc204d1345ba2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f2fc58b2df08d52f991cc204d1345ba2_JaffaCakes118.exe startC:\Program Files (x86)\F9C67\lvvm.exe%C:\Program Files (x86)\F9C672⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD57bd29eb22f49ecbe5a52904192d29c95
SHA1a6fda4dbf8bb7b80beefc7ca770423263b09f6d9
SHA256fb7147d4f4dd3e26d08b9126945469f03ecff2f035e00141e561b9f299ba7fd0
SHA5123d1b4a0256acfea38271854a2e4b533dc794a53b91687701c79b8ffa0cc65601eb1eeed5e6b8def7042c43641ca1eccbbe94fb1008786458a210f219723ad32d
-
Filesize
420B
MD5b523d9ca51b2daaa6d8675dc75dd76cd
SHA1f546fe3e92ede126359abd3ea108d689188aba24
SHA256b6243538aa96410ad3cbc74b8bfbe13a0d7ec1971b4ae9f746c90a6f3f016ac8
SHA5127e24fdaf530f5499a1cbcd4886f24afb2f1eb7e25d6693c0b5c9b6050ceb0187d1872e9c575b9df45300b894dbdfd0c1b9111de2fdb9436b88bc06302b92d9e0
-
Filesize
600B
MD52f8ab3f7817795effa5dd18031a52d7e
SHA15315f1605f2c4e4b31a00bc98dcae38c5e3b5204
SHA2560b32605557f9122ce74afa0a2f2ab84aeb38b52ade9199bae26562484245437a
SHA5122afa328bc02e75f4cb6fb9dbe7d79bde73653ab920ed35e7861e3e375310d4e6ba553d60c5b91e751e76c874b9cf74dfb1e3ca779bd3d1155f166e3de6b1f6c0
-
Filesize
1KB
MD5d30027e42da7b98250409529cf4ac4b3
SHA16e59c60128e4e21150f098211fdafff70ba606b3
SHA256c6eff342e8d96841088886c58baf17636c3c6cdbc25049ddb56f7ffebfd8acff
SHA51288f73c9c2e0d777fd903fa15f5b2be2d7001a474a5bc0631cd008547c6f6dedb58436255020e8015bec03af87711fd2e09cb7f012069d30b1ad0aba61d74de06
-
Filesize
996B
MD5bfc560e5eb4cf2f50820f80f6ba91375
SHA17721944250b23e2ce35cb57f22e3523e1e7adb02
SHA2565d472674ede30c8fbda36a0852b2b33fb01af48cc81a9a058301d8fd1d135635
SHA512795e20168501c6c72a59a1a37eb70d15f54512fe5e7588e9f5b0e40348b043dd794b564ff37204435c6aea88e2393f11b9da35b8109eb37b2e8e79b7a2a68af9
-
Filesize
428KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
428KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB