Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2024 10:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe
-
Size
76KB
-
MD5
176490eeb06579d38e87ae9420d58baf
-
SHA1
e687b711fdafa7d455729c0c5b8105b9360963f6
-
SHA256
ab934e7c9ac13f178d3ee033579467a6171d13ade679e714b52b8f8f54af55e3
-
SHA512
b14d8725809a32ef905594c485e3fcb6d822e1d65f171d24f536246b35bf30185b755665337124ce6f2d10bf2f61f0017c60b93d65e2e5b8f8e45c840431c3a3
-
SSDEEP
768:9JPHOF3W8nMIbk6KQVEs8rA7FYM9M6Ap9riiJtXbxaEyQkhzyqeIdVVyeoUG79p3:9Jf83W8W60IL26Ap8iJJ3BSeIDIJVpp3
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" Fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" SVIQ.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" dc.exe -
Executes dropped EXE 3 IoCs
pid Process 2364 Fun.exe 1580 SVIQ.EXE 5040 dc.exe -
Loads dropped DLL 4 IoCs
pid Process 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 2364 Fun.exe 1580 SVIQ.EXE 5040 dc.exe -
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" dc.exe -
Drops file in System32 directory 20 IoCs
description ioc Process File created C:\Windows\SysWOW64\WinSit.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\vcmgcd32.dl_ Fun.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe SVIQ.EXE File opened for modification C:\Windows\SysWOW64\Penx.dat Fun.exe File created C:\Windows\SysWOW64\vcmgcd32.dl_ 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe Fun.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe Fun.exe File created C:\Windows\SysWOW64\vcmgcd32.dll dc.exe File created C:\Windows\SysWOW64\vcmgcd32.dll 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File created C:\Windows\SysWOW64\config\Win.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File created C:\Windows\SysWOW64\vcmgcd32.dll Fun.exe File created C:\Windows\SysWOW64\vcmgcd32.dll SVIQ.EXE File opened for modification C:\Windows\SysWOW64\vcmgcd32.dl_ dc.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe dc.exe File opened for modification C:\Windows\SysWOW64\vcmgcd32.dl_ SVIQ.EXE File opened for modification C:\Windows\SysWOW64\WinSit.exe SVIQ.EXE File opened for modification C:\Windows\SysWOW64\WinSit.exe dc.exe File opened for modification C:\Windows\SysWOW64\Xpen.dat Fun.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE Fun.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe Fun.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe Fun.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe Fun.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe Fun.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe Fun.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe Fun.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe Fun.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe Fun.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe Fun.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe Fun.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe Fun.exe -
Drops file in Windows directory 38 IoCs
description ioc Process File created C:\Windows\dc.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\dc.exe SVIQ.EXE File opened for modification C:\Windows\SVIQ.exe SVIQ.EXE File opened for modification C:\Windows\inf\Other.exe SVIQ.EXE File opened for modification C:\Windows\wininit.ini SVIQ.EXE File opened for modification C:\Windows\Help\Other.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File created C:\Windows\SVIQ.EXE SVIQ.EXE File opened for modification C:\Windows\system\Fun.exe SVIQ.EXE File opened for modification C:\Windows\dc.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\SVIQ.EXE 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\Help\Other.exe Fun.exe File opened for modification C:\Windows\inf\Other.exe dc.exe File opened for modification C:\Windows\wininit.ini dc.exe File opened for modification C:\Windows\system\Fun.exe dc.exe File created C:\Windows\system\Fun.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\wininit.ini 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\Help\Other.exe SVIQ.EXE File created C:\Windows\dc.exe dc.exe File opened for modification C:\WINDOWS\SVIQ.EXE Fun.exe File opened for modification C:\Windows\SYSTEM.INI 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File created C:\Windows\SVIQ.EXE 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\inf\Other.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File created C:\Windows\system\Fun.exe Fun.exe File opened for modification C:\Windows\inf\Other.exe Fun.exe File opened for modification C:\Windows\wininit.ini Fun.exe File created C:\Windows\system\Fun.exe dc.exe File opened for modification C:\Windows\Help\Other.exe dc.exe File opened for modification C:\Windows\system\Fun.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File created C:\Windows\inf\Other.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\dc.exe Fun.exe File opened for modification C:\Windows\SVIQ.EXE Fun.exe File opened for modification C:\Windows\system\Fun.exe Fun.exe File opened for modification C:\WINDOWS\DC.EXE Fun.exe File opened for modification C:\WINDOWS\SYSTEM\FUN.EXE Fun.exe File created C:\Windows\Help\Other.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File created C:\Windows\system\Fun.exe SVIQ.EXE File created C:\Windows\SVIQ.EXE dc.exe File opened for modification C:\Windows\dc.exe dc.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVIQ.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 2364 Fun.exe 2364 Fun.exe 1580 SVIQ.EXE 1580 SVIQ.EXE 5040 dc.exe 5040 dc.exe 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 2364 Fun.exe 2364 Fun.exe 1580 SVIQ.EXE 1580 SVIQ.EXE 5040 dc.exe 5040 dc.exe 2364 Fun.exe 2364 Fun.exe 1580 SVIQ.EXE 1580 SVIQ.EXE 5040 dc.exe 5040 dc.exe 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 2364 Fun.exe 2364 Fun.exe 1580 SVIQ.EXE 1580 SVIQ.EXE 5040 dc.exe 5040 dc.exe 2364 Fun.exe 2364 Fun.exe 1580 SVIQ.EXE 1580 SVIQ.EXE 5040 dc.exe 5040 dc.exe 2364 Fun.exe 2364 Fun.exe 1580 SVIQ.EXE 1580 SVIQ.EXE 5040 dc.exe 5040 dc.exe 2364 Fun.exe 2364 Fun.exe 1580 SVIQ.EXE 1580 SVIQ.EXE 5040 dc.exe 5040 dc.exe 2364 Fun.exe 2364 Fun.exe 1580 SVIQ.EXE 1580 SVIQ.EXE 5040 dc.exe 5040 dc.exe 2364 Fun.exe 2364 Fun.exe 1580 SVIQ.EXE 1580 SVIQ.EXE 5040 dc.exe 5040 dc.exe 2364 Fun.exe 2364 Fun.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 2364 Fun.exe 2364 Fun.exe 1580 SVIQ.EXE 1580 SVIQ.EXE 5040 dc.exe 5040 dc.exe 2364 Fun.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5560 wrote to memory of 2364 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 89 PID 5560 wrote to memory of 2364 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 89 PID 5560 wrote to memory of 2364 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 89 PID 2364 wrote to memory of 1580 2364 Fun.exe 90 PID 2364 wrote to memory of 1580 2364 Fun.exe 90 PID 2364 wrote to memory of 1580 2364 Fun.exe 90 PID 5560 wrote to memory of 5040 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 91 PID 5560 wrote to memory of 5040 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 91 PID 5560 wrote to memory of 5040 5560 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Windows\system\Fun.exeC:\Windows\system\Fun.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SVIQ.EXEC:\Windows\SVIQ.EXE3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1580
-
-
-
C:\Windows\dc.exeC:\Windows\dc.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4384,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:81⤵PID:3020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5176490eeb06579d38e87ae9420d58baf
SHA1e687b711fdafa7d455729c0c5b8105b9360963f6
SHA256ab934e7c9ac13f178d3ee033579467a6171d13ade679e714b52b8f8f54af55e3
SHA512b14d8725809a32ef905594c485e3fcb6d822e1d65f171d24f536246b35bf30185b755665337124ce6f2d10bf2f61f0017c60b93d65e2e5b8f8e45c840431c3a3
-
Filesize
261B
MD5b95c31e5a3751c4f95d6ca8fcb1d619d
SHA1cfac661c91861e236da0792e753ddf36680b010e
SHA25678bdee9d652c1b9dfddec42cab0a3e0ffb8c86fbda6578e689c15f36ae5c31d7
SHA51217da1d82bbc72cf942c0e17cc7ded5876a26bc5e82ada237992382aa1427d668cec03ef975323d6696826684df947f83a32e3f13256d18ae87557981fe2cbf9b
-
Filesize
17KB
MD565ec81c36efd75f8e4490b0d42aa2ced
SHA19be34710a967a4ecd5a7e6be0568bf8e2d9be007
SHA256021dde0dc1ee1a9fd800a889885e91f345acc916fb852850f0adb0257903fa04
SHA5127ece65926ca500015b0722e2c0d071124dc951accad36390a4aee62da72ecf592e54ff815e5de056696102a6a397d6b9c5d59e263efee7e1582e303348194bdd
-
Filesize
36KB
MD5ae22ca9f11ade8e362254b452cc07f78
SHA14b3cb548c547d3be76e571e0579a609969b05975
SHA25620cbcc9d1e6bd3c7ccacbe81fd26551b2ccfc02c00e8f948b9e9016c8b401db6
SHA5129e1c725758a284ec9132f393a0b27b019a7dde32dc0649b468152876b1c77b195abc9689b732144d8c5b4d0b5fcb960a3074264cab75e6681932d3da2a644bc1
-
Filesize
41B
MD5e839977c0d22c9aa497b0b1d90d8a372
SHA1b5048e501399138796b38f3d3666e1a88c397e83
SHA256478db7f82fd7ef4860f7acd2f534ec303175500d7f4e1e36161d31c900d234e2
SHA5124c8ba5a26b6f738f8d25c32d019cee63e9a32d28e3aeb8fe31b965d7603c24a3539e469c8eb569747b47dadc9c43cdd1066ddb37ed8138bee5d0c74b5d0c275d