Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 21:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
General
-
Target
f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe
-
Size
318KB
-
MD5
f6deaf165da7a337c68048a046178c57
-
SHA1
ff6ce2d1eb1d81a392e0b6acf02017fbbf526181
-
SHA256
d19c4864f78997a15056dd3dd3e53e144c412d1add11866ed2b36c6e933797a5
-
SHA512
ba8f18fc2806e3325e09dd7aef269da6eacf6ce6a884b87b4e354b311106a0f24bbc147ba987087bdfa861d395b9412c5464efbd7a570d51a4d0d75a83dc5562
-
SSDEEP
6144:gTu5OUFQPwNcv0kPmAGsyRILcAHRsNW+oKE0QJDBx0KEVaLOrd8ZH22aY:iuzmOCzGyiNW+oz06Bx0fByH2BY
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2852 explorer.exe -
Executes dropped EXE 3 IoCs
pid Process 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe -
Loads dropped DLL 6 IoCs
pid Process 2916 f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe 2916 f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe 2852 explorer.exe 2852 explorer.exe 2716 nvxdsinc.exe 2716 nvxdsinc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\nvxdsinc.exe" nvxdsinc.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2852 set thread context of 984 2852 explorer.exe 31 PID 2880 set thread context of 2628 2880 nwtray.exe 34 -
resource yara_rule behavioral1/memory/984-29-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/984-30-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/984-28-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/984-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/984-33-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/984-32-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/984-25-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/984-24-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/984-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/984-36-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/984-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvxdsinc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nwtray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe 2716 nvxdsinc.exe 2880 nwtray.exe 2852 explorer.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 2916 f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe Token: SeDebugPrivilege 2852 explorer.exe Token: SeIncreaseQuotaPrivilege 984 AppLaunch.exe Token: SeSecurityPrivilege 984 AppLaunch.exe Token: SeTakeOwnershipPrivilege 984 AppLaunch.exe Token: SeLoadDriverPrivilege 984 AppLaunch.exe Token: SeSystemProfilePrivilege 984 AppLaunch.exe Token: SeSystemtimePrivilege 984 AppLaunch.exe Token: SeProfSingleProcessPrivilege 984 AppLaunch.exe Token: SeIncBasePriorityPrivilege 984 AppLaunch.exe Token: SeCreatePagefilePrivilege 984 AppLaunch.exe Token: SeBackupPrivilege 984 AppLaunch.exe Token: SeRestorePrivilege 984 AppLaunch.exe Token: SeShutdownPrivilege 984 AppLaunch.exe Token: SeDebugPrivilege 984 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 984 AppLaunch.exe Token: SeChangeNotifyPrivilege 984 AppLaunch.exe Token: SeRemoteShutdownPrivilege 984 AppLaunch.exe Token: SeUndockPrivilege 984 AppLaunch.exe Token: SeManageVolumePrivilege 984 AppLaunch.exe Token: SeImpersonatePrivilege 984 AppLaunch.exe Token: SeCreateGlobalPrivilege 984 AppLaunch.exe Token: 33 984 AppLaunch.exe Token: 34 984 AppLaunch.exe Token: 35 984 AppLaunch.exe Token: SeDebugPrivilege 2716 nvxdsinc.exe Token: SeDebugPrivilege 2880 nwtray.exe Token: SeIncreaseQuotaPrivilege 2628 AppLaunch.exe Token: SeSecurityPrivilege 2628 AppLaunch.exe Token: SeTakeOwnershipPrivilege 2628 AppLaunch.exe Token: SeLoadDriverPrivilege 2628 AppLaunch.exe Token: SeSystemProfilePrivilege 2628 AppLaunch.exe Token: SeSystemtimePrivilege 2628 AppLaunch.exe Token: SeProfSingleProcessPrivilege 2628 AppLaunch.exe Token: SeIncBasePriorityPrivilege 2628 AppLaunch.exe Token: SeCreatePagefilePrivilege 2628 AppLaunch.exe Token: SeBackupPrivilege 2628 AppLaunch.exe Token: SeRestorePrivilege 2628 AppLaunch.exe Token: SeShutdownPrivilege 2628 AppLaunch.exe Token: SeDebugPrivilege 2628 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 2628 AppLaunch.exe Token: SeChangeNotifyPrivilege 2628 AppLaunch.exe Token: SeRemoteShutdownPrivilege 2628 AppLaunch.exe Token: SeUndockPrivilege 2628 AppLaunch.exe Token: SeManageVolumePrivilege 2628 AppLaunch.exe Token: SeImpersonatePrivilege 2628 AppLaunch.exe Token: SeCreateGlobalPrivilege 2628 AppLaunch.exe Token: 33 2628 AppLaunch.exe Token: 34 2628 AppLaunch.exe Token: 35 2628 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 984 AppLaunch.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2852 2916 f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe 30 PID 2916 wrote to memory of 2852 2916 f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe 30 PID 2916 wrote to memory of 2852 2916 f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe 30 PID 2916 wrote to memory of 2852 2916 f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe 30 PID 2852 wrote to memory of 984 2852 explorer.exe 31 PID 2852 wrote to memory of 984 2852 explorer.exe 31 PID 2852 wrote to memory of 984 2852 explorer.exe 31 PID 2852 wrote to memory of 984 2852 explorer.exe 31 PID 2852 wrote to memory of 984 2852 explorer.exe 31 PID 2852 wrote to memory of 984 2852 explorer.exe 31 PID 2852 wrote to memory of 984 2852 explorer.exe 31 PID 2852 wrote to memory of 984 2852 explorer.exe 31 PID 2852 wrote to memory of 984 2852 explorer.exe 31 PID 2852 wrote to memory of 984 2852 explorer.exe 31 PID 2852 wrote to memory of 984 2852 explorer.exe 31 PID 2852 wrote to memory of 2716 2852 explorer.exe 32 PID 2852 wrote to memory of 2716 2852 explorer.exe 32 PID 2852 wrote to memory of 2716 2852 explorer.exe 32 PID 2852 wrote to memory of 2716 2852 explorer.exe 32 PID 2716 wrote to memory of 2880 2716 nvxdsinc.exe 33 PID 2716 wrote to memory of 2880 2716 nvxdsinc.exe 33 PID 2716 wrote to memory of 2880 2716 nvxdsinc.exe 33 PID 2716 wrote to memory of 2880 2716 nvxdsinc.exe 33 PID 2880 wrote to memory of 2628 2880 nwtray.exe 34 PID 2880 wrote to memory of 2628 2880 nwtray.exe 34 PID 2880 wrote to memory of 2628 2880 nwtray.exe 34 PID 2880 wrote to memory of 2628 2880 nwtray.exe 34 PID 2880 wrote to memory of 2628 2880 nwtray.exe 34 PID 2880 wrote to memory of 2628 2880 nwtray.exe 34 PID 2880 wrote to memory of 2628 2880 nwtray.exe 34 PID 2880 wrote to memory of 2628 2880 nwtray.exe 34 PID 2880 wrote to memory of 2628 2880 nwtray.exe 34 PID 2880 wrote to memory of 2628 2880 nwtray.exe 34 PID 2880 wrote to memory of 2628 2880 nwtray.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:984
-
-
C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe"C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84B
MD58922901d63b9e2258191ccb4a17c6652
SHA1220ea54ec503be0dc8e98816f3f50f84eabec6f4
SHA2560c4eba0fba9195a885727f305e6be04f4906ddfc979f82b31e55afebbfa3fa3a
SHA512660a51f4df1ed354424538224cc5756a12eb752124fcc271283a417870db56261da82c66b77732da9ce30a2dc452fd407f0292447432b5b68118519bb07d55f6
-
Filesize
39KB
MD538abcaec6ee62213f90b1717d830a1bb
SHA1d8f5849d0d3f4ccc0dfb66a9a4a0442ac66a31b9
SHA2566fee9a2c70b2cc48b0812f7cb2e09497c9c90941976f430a8f8279ad3c787768
SHA51277eaabcbc6f7a3835b6220d72c4b1cae82d2125ea971907e33b15ceeede7e4da0741c6e63e988bd782ed6eb72ad3cbcba10ea83919eafd9b95d612c43a735274
-
Filesize
318KB
MD5f6deaf165da7a337c68048a046178c57
SHA1ff6ce2d1eb1d81a392e0b6acf02017fbbf526181
SHA256d19c4864f78997a15056dd3dd3e53e144c412d1add11866ed2b36c6e933797a5
SHA512ba8f18fc2806e3325e09dd7aef269da6eacf6ce6a884b87b4e354b311106a0f24bbc147ba987087bdfa861d395b9412c5464efbd7a570d51a4d0d75a83dc5562