Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2024 17:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
General
-
Target
f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe
-
Size
252KB
-
MD5
f68008057ff5dbc67c938b3f5f68a54d
-
SHA1
03347080f09deb58f7059a4774da66c3f71890c3
-
SHA256
d91807db680531bc9f41c4d56229558f39f04c0adef4448be9d5b4691eb919e8
-
SHA512
0baccb957a9dc955868226665f6fd7bd938d18191e6c364c5c062887378001b0ea286921cca005005cdda307455afc1e70590a18695aa7921a76cb60bff3b9d5
-
SSDEEP
3072:Wk/G2ulyaBYjv/1AnfZoGe9vf95ZKzrde6z2CTaK124CSbUeG7zMCnZf9v:W72+GL9An+ZfPA1SKklSbUHzMCZf
Malware Config
Signatures
-
Detects PlugX payload 18 IoCs
resource yara_rule behavioral2/memory/3156-2-0x0000000003770000-0x000000000379E000-memory.dmp family_plugx behavioral2/memory/3156-3-0x0000000003770000-0x000000000379E000-memory.dmp family_plugx behavioral2/memory/4328-4-0x0000000001100000-0x000000000112E000-memory.dmp family_plugx behavioral2/memory/4328-8-0x0000000001100000-0x000000000112E000-memory.dmp family_plugx behavioral2/memory/4328-20-0x0000000001100000-0x000000000112E000-memory.dmp family_plugx behavioral2/memory/4328-22-0x0000000001100000-0x000000000112E000-memory.dmp family_plugx behavioral2/memory/4328-21-0x0000000001100000-0x000000000112E000-memory.dmp family_plugx behavioral2/memory/4328-19-0x0000000001100000-0x000000000112E000-memory.dmp family_plugx behavioral2/memory/4328-6-0x0000000001100000-0x000000000112E000-memory.dmp family_plugx behavioral2/memory/4600-23-0x0000000002780000-0x00000000027AE000-memory.dmp family_plugx behavioral2/memory/4600-28-0x0000000002780000-0x00000000027AE000-memory.dmp family_plugx behavioral2/memory/4600-27-0x0000000002780000-0x00000000027AE000-memory.dmp family_plugx behavioral2/memory/4600-25-0x0000000002780000-0x00000000027AE000-memory.dmp family_plugx behavioral2/memory/4328-29-0x0000000001100000-0x000000000112E000-memory.dmp family_plugx behavioral2/memory/4328-30-0x0000000001100000-0x000000000112E000-memory.dmp family_plugx behavioral2/memory/4328-31-0x0000000001100000-0x000000000112E000-memory.dmp family_plugx behavioral2/memory/4600-33-0x0000000002780000-0x00000000027AE000-memory.dmp family_plugx behavioral2/memory/4328-40-0x0000000001100000-0x000000000112E000-memory.dmp family_plugx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\MJ svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\MJ\CLSID = 37003300360030004400330037003300450044003300410036003600320039000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4328 svchost.exe 4328 svchost.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4328 svchost.exe 4328 svchost.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4328 svchost.exe 4328 svchost.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4328 svchost.exe 4328 svchost.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4328 svchost.exe 4328 svchost.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe 4600 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4328 svchost.exe 4600 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3156 f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe Token: SeTcbPrivilege 3156 f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe Token: SeDebugPrivilege 4328 svchost.exe Token: SeTcbPrivilege 4328 svchost.exe Token: SeDebugPrivilege 4600 msiexec.exe Token: SeTcbPrivilege 4600 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3156 wrote to memory of 4328 3156 f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe 82 PID 3156 wrote to memory of 4328 3156 f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe 82 PID 3156 wrote to memory of 4328 3156 f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe 82 PID 3156 wrote to memory of 4328 3156 f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe 82 PID 3156 wrote to memory of 4328 3156 f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe 82 PID 3156 wrote to memory of 4328 3156 f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe 82 PID 3156 wrote to memory of 4328 3156 f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe 82 PID 3156 wrote to memory of 4328 3156 f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe 82 PID 4328 wrote to memory of 4600 4328 svchost.exe 85 PID 4328 wrote to memory of 4600 4328 svchost.exe 85 PID 4328 wrote to memory of 4600 4328 svchost.exe 85 PID 4328 wrote to memory of 4600 4328 svchost.exe 85 PID 4328 wrote to memory of 4600 4328 svchost.exe 85 PID 4328 wrote to memory of 4600 4328 svchost.exe 85 PID 4328 wrote to memory of 4600 4328 svchost.exe 85 PID 4328 wrote to memory of 4600 4328 svchost.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f68008057ff5dbc67c938b3f5f68a54d_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
-