Analysis
-
max time kernel
146s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 21:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe
-
Size
33KB
-
MD5
1501e634d1a7e337d390ed9d3b820610
-
SHA1
57c4f3722af016d3e7406872e66c5e4a251384f9
-
SHA256
02c4c67334b0d41b1e3600ef4e48820272637798cda4390336d86536948264ab
-
SHA512
cd187df5beafcdf74fc6a0c83a7854b8cbf6611fe1d48f2fdea6870617077a86b91e989435096f31a9062d09bed2a37bb190b781ee733a9bb4e65ada98c1bfc2
-
SSDEEP
768:BFJTsmjBNetbfQHGZ+aHVuPO4Jdgkaq4wN:HhnreRfQm/ezpj
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Mousie = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\XP.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sos.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logogo.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit32.Exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logogo.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UFO.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UFO.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernelwind32.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.EXE\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cross.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.Exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe\Debugger = "C:\\Windows\\system32\\Mousie.exe" 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Mousie.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Mousie.exe 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4892 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe 4892 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe 4892 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe 4892 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4892 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer 1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1501e634d1a7e337d390ed9d3b820610_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Event Triggered Execution: Image File Execution Options Injection
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4892
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1