Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/10/2024, 03:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
General
- Target 29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
- Size 257KB
- Sample241009-dycbbsthkc
- SHA256 d64e5a258078f6655b3aa40e7bb897ff9856151b4adcdd1f5723a8b9e02bb88a
- MD5 29f0bc408d724050e92230285592be7f
- SHA1 d31fca6aea10ed571d2ffce375cfd27b6d0871f3
- SHA512 24b5ff00b7dc75e292ee104e1d9176e25c45df3907470ec2795754c026c2db02023249cffacc0757fdd10882d1ba26488350e0bbd29b4b6e5feebce5fafe9f89
- SSDEEP 6144:S0L10u6oC8DyzBcniBdBuGoEim9N1vXp:S0Z0jV8DacnchJ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects PlugX payload 25 IoCs
resource yara_rule behavioral2/memory/2576-1-0x0000000002E50000-0x0000000002E8C000-memory.dmp family_plugx behavioral2/memory/4020-20-0x0000000000930000-0x000000000096C000-memory.dmp family_plugx behavioral2/memory/4020-19-0x0000000000930000-0x000000000096C000-memory.dmp family_plugx behavioral2/memory/2260-25-0x0000000001460000-0x000000000149C000-memory.dmp family_plugx behavioral2/memory/2260-24-0x0000000001460000-0x000000000149C000-memory.dmp family_plugx behavioral2/memory/4316-29-0x0000000001500000-0x000000000153C000-memory.dmp family_plugx behavioral2/memory/2576-28-0x0000000002E50000-0x0000000002E8C000-memory.dmp family_plugx behavioral2/memory/4316-27-0x0000000001500000-0x000000000153C000-memory.dmp family_plugx behavioral2/memory/2260-33-0x0000000001460000-0x000000000149C000-memory.dmp family_plugx behavioral2/memory/4316-45-0x0000000001500000-0x000000000153C000-memory.dmp family_plugx behavioral2/memory/4316-46-0x0000000001500000-0x000000000153C000-memory.dmp family_plugx behavioral2/memory/4316-52-0x0000000001500000-0x000000000153C000-memory.dmp family_plugx behavioral2/memory/4316-53-0x0000000001500000-0x000000000153C000-memory.dmp family_plugx behavioral2/memory/4316-48-0x0000000001500000-0x000000000153C000-memory.dmp family_plugx behavioral2/memory/4316-31-0x0000000001500000-0x000000000153C000-memory.dmp family_plugx behavioral2/memory/4020-57-0x0000000000930000-0x000000000096C000-memory.dmp family_plugx behavioral2/memory/4020-58-0x0000000000930000-0x000000000096C000-memory.dmp family_plugx behavioral2/memory/4316-59-0x0000000001500000-0x000000000153C000-memory.dmp family_plugx behavioral2/memory/1260-62-0x00000000028C0000-0x00000000028FC000-memory.dmp family_plugx behavioral2/memory/1260-61-0x00000000028C0000-0x00000000028FC000-memory.dmp family_plugx behavioral2/memory/4316-63-0x0000000001500000-0x000000000153C000-memory.dmp family_plugx behavioral2/memory/1260-65-0x00000000028C0000-0x00000000028FC000-memory.dmp family_plugx behavioral2/memory/1260-66-0x00000000028C0000-0x00000000028FC000-memory.dmp family_plugx behavioral2/memory/1260-67-0x00000000028C0000-0x00000000028FC000-memory.dmp family_plugx behavioral2/memory/4316-70-0x0000000001500000-0x000000000153C000-memory.dmp family_plugx - Deletes itself 1 IoCs
pid Process 4020 rc.exe - Executes dropped EXE 2 IoCs
pid Process 4020 rc.exe 2260 rc.exe - Loads dropped DLL 2 IoCs
pid Process 4020 rc.exe 2260 rc.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29f0bc408d724050e92230285592be7f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Modifies data under HKEY_USERS 17 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows svchost.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 44003400410035003100420035003400350034004600440042003100420043000000 svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4316 svchost.exe 4316 svchost.exe 4316 svchost.exe 4316 svchost.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 4316 svchost.exe 4316 svchost.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 4316 svchost.exe 4316 svchost.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 4316 svchost.exe 4316 svchost.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 4316 svchost.exe 4316 svchost.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 1260 msiexec.exe 4316 svchost.exe 4316 svchost.exe 1260 msiexec.exe 1260 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4316 svchost.exe 1260 msiexec.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2576 29f0bc408d724050e92230285592be7f_JaffaCakes118.exe Token: SeTcbPrivilege 2576 29f0bc408d724050e92230285592be7f_JaffaCakes118.exe Token: SeDebugPrivilege 4020 rc.exe Token: SeTcbPrivilege 4020 rc.exe Token: SeDebugPrivilege 2260 rc.exe Token: SeTcbPrivilege 2260 rc.exe Token: SeDebugPrivilege 4316 svchost.exe Token: SeTcbPrivilege 4316 svchost.exe Token: SeDebugPrivilege 1260 msiexec.exe Token: SeTcbPrivilege 1260 msiexec.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2576 wrote to memory of 4020 2576 29f0bc408d724050e92230285592be7f_JaffaCakes118.exe 84 PID 2576 wrote to memory of 4020 2576 29f0bc408d724050e92230285592be7f_JaffaCakes118.exe 84 PID 2576 wrote to memory of 4020 2576 29f0bc408d724050e92230285592be7f_JaffaCakes118.exe 84 PID 2260 wrote to memory of 4316 2260 rc.exe 89 PID 2260 wrote to memory of 4316 2260 rc.exe 89 PID 2260 wrote to memory of 4316 2260 rc.exe 89 PID 2260 wrote to memory of 4316 2260 rc.exe 89 PID 2260 wrote to memory of 4316 2260 rc.exe 89 PID 2260 wrote to memory of 4316 2260 rc.exe 89 PID 2260 wrote to memory of 4316 2260 rc.exe 89 PID 2260 wrote to memory of 4316 2260 rc.exe 89 PID 4316 wrote to memory of 1260 4316 svchost.exe 90 PID 4316 wrote to memory of 1260 4316 svchost.exe 90 PID 4316 wrote to memory of 1260 4316 svchost.exe 90 PID 4316 wrote to memory of 1260 4316 svchost.exe 90 PID 4316 wrote to memory of 1260 4316 svchost.exe 90 PID 4316 wrote to memory of 1260 4316 svchost.exe 90 PID 4316 wrote to memory of 1260 4316 svchost.exe 90 PID 4316 wrote to memory of 1260 4316 svchost.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\29f0bc408d724050e92230285592be7f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\29f0bc408d724050e92230285592be7f_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\ProgramData\SxS\rc.exe"C:\ProgramData\SxS\rc.exe" 100 25762⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
-
C:\ProgramData\SxS\rc.exe"C:\ProgramData\SxS\rc.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 43163⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SxS\RCDLL.dll
- Size 4KB
- SHA256 85ff99a6e80c0b86cca82ee28610411edcb8b703b4d8e3fd91bfd4938b7c3180
- MD5 950d81456a42e1c39a6660554501f91e
- SHA1 bf673d59936c221736fdf55fc4f1816bff6e5dfd
- SHA512 90963d5b1c1072ce3e681d8a59fdd3e9547db53204ae1798e44afd3bf91907c26f9d3f793c566ee0dd2811fed9db7ffe0815e6edf11aa8da6b7ca52bd41a34ee
- MD5 SHA1 SHA512
- Path C:\ProgramData\SxS\bug.log
- Size 622B
- SHA256 adcae69d9cdc5832c92d798455a6fd5388bf31bccba9fdc5d3d90c95b8800478
- MD5 2375d0fbf27164012bb2d220e9c0fa3a
- SHA1 8390d84e1a0f295babc12354e672b62bcc006bd7
- SHA512 f67bd807c4fb99adf3ec024c167b3d9894ed02e06fb86cba390afc378b7c7cb85a962f045f2cbf98a24fb3ab1636b1edfb44e4beec3073609625793821d18f25
- MD5 SHA1 SHA512
- Path C:\ProgramData\SxS\rc.exe
- Size 67KB
- SHA256 83be17ad26522c9e0e6b28c8638c6548908baeb1e945db77b747ff85e74fea3c
- MD5 3560bc05de9f7ef2df54495a4c6774f8
- SHA1 7f64b41b320913ecc10bbe251fe1f169c5520d20
- SHA512 1ca4533b00800d0c68560983993dfccc600e1405583cb597fbb5c7248f81b6399d9976857a945453e5cf7e2778ae1e3f28c69c6af1d09bf8b7166c71d4b94740
- SSDEEP 1536:VeEASgKu0ZdZKGe0bbW05R4T6kQ5Hd64YuMzXafdUafd4Fae7m:VeEBu0ZdZD4m5MbjjafOafaEJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\SxS\rc.hlp
- Size 167KB
- SHA256 1a865b1a682fba71276f0bfaf454846663dc7e18680271ebd346ccdef3b4b54c
- MD5 d63ded61435f458b8e22f8bca68393f0
- SHA1 8a828124d6b66f35018954226194ad2048ca46e9
- SHA512 e19befc0cfbf8e3b2ebbf88fea76a83d5cb989775ce35600fc50084e3f932da9dc5b786e17ce8374fd68f21eaa9f8bef9a6e278a6a88f4261c63b934405f3707
- SSDEEP 3072:2YY14hNjoC8DyznBc08HipcaPflBuGdNeKchiim9OIFPvHCK:Q6oC8DyzBcniBdBuGoEim9N1v
- MD5 SHA1 SHA512 SSDEEP