Analysis
-
max time kernel
96s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 22:33
Static task
static1
Behavioral task
behavioral1
Sample
3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe
-
Size
993KB
-
MD5
3216b81f9731256d3fe49c62121990a0
-
SHA1
31bf55a24ade293b3ea91416a9cfe0d2caa9b1c3
-
SHA256
7467389d865089caa1830efa45ba37ff408f723dd0debf0e94d3fe4376aa1408
-
SHA512
7a6ba796d6eb647669596c1402c6f54a265383e30cdb45a896241bb2513881e374ddc065230aaef8c0b572954f50548b52ac63afeda80f6efd1addb6e4529286
-
SSDEEP
24576:F1CjRNrxmiRwxeFfZMRWn1fObCb4yZQgr:F2NNmvEFOotr6k
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2684 attrib.exe 4144 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation vbc.exe -
Executes dropped EXE 2 IoCs
pid Process 2488 vbc.exe 2124 msdcsc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdtr = "C:\\Users\\Admin\\AppData\\Roaming\\WinUpdtr\\3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe" 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1588 set thread context of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2488 vbc.exe Token: SeSecurityPrivilege 2488 vbc.exe Token: SeTakeOwnershipPrivilege 2488 vbc.exe Token: SeLoadDriverPrivilege 2488 vbc.exe Token: SeSystemProfilePrivilege 2488 vbc.exe Token: SeSystemtimePrivilege 2488 vbc.exe Token: SeProfSingleProcessPrivilege 2488 vbc.exe Token: SeIncBasePriorityPrivilege 2488 vbc.exe Token: SeCreatePagefilePrivilege 2488 vbc.exe Token: SeBackupPrivilege 2488 vbc.exe Token: SeRestorePrivilege 2488 vbc.exe Token: SeShutdownPrivilege 2488 vbc.exe Token: SeDebugPrivilege 2488 vbc.exe Token: SeSystemEnvironmentPrivilege 2488 vbc.exe Token: SeChangeNotifyPrivilege 2488 vbc.exe Token: SeRemoteShutdownPrivilege 2488 vbc.exe Token: SeUndockPrivilege 2488 vbc.exe Token: SeManageVolumePrivilege 2488 vbc.exe Token: SeImpersonatePrivilege 2488 vbc.exe Token: SeCreateGlobalPrivilege 2488 vbc.exe Token: 33 2488 vbc.exe Token: 34 2488 vbc.exe Token: 35 2488 vbc.exe Token: 36 2488 vbc.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 1588 wrote to memory of 2488 1588 3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe 86 PID 2488 wrote to memory of 1952 2488 vbc.exe 87 PID 2488 wrote to memory of 1952 2488 vbc.exe 87 PID 2488 wrote to memory of 1952 2488 vbc.exe 87 PID 2488 wrote to memory of 216 2488 vbc.exe 89 PID 2488 wrote to memory of 216 2488 vbc.exe 89 PID 2488 wrote to memory of 216 2488 vbc.exe 89 PID 2488 wrote to memory of 2124 2488 vbc.exe 91 PID 2488 wrote to memory of 2124 2488 vbc.exe 91 PID 2488 wrote to memory of 2124 2488 vbc.exe 91 PID 216 wrote to memory of 2684 216 cmd.exe 93 PID 216 wrote to memory of 2684 216 cmd.exe 93 PID 216 wrote to memory of 2684 216 cmd.exe 93 PID 1952 wrote to memory of 4144 1952 cmd.exe 94 PID 1952 wrote to memory of 4144 1952 cmd.exe 94 PID 1952 wrote to memory of 4144 1952 cmd.exe 94 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2684 attrib.exe 4144 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3216b81f9731256d3fe49c62121990a0_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\vbc.exeC:\Users\Admin\AppData\Local\Temp\vbc.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4144
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2684
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2124
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD5b774ae3fb1da087e1f83b4f7b2060e5a
SHA197eb9be49ac3af9c851c9e1e84e32bfd53e325a8
SHA256adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b
SHA512f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34