Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 23:37
Static task
static1
Behavioral task
behavioral1
Sample
4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe
-
Size
263KB
-
MD5
4a82471b1cdc5f3661b0d8c40f8046cd
-
SHA1
ce34d8c2ebd1ae8deac602d89625871be0c4b3c7
-
SHA256
66e69609fd141fe7c16c728fa8f02280d1dc2994b93f78e7fb2e745ccfedc644
-
SHA512
d4caf454ef9df0d94c7b27b3e5217c873ec81ae1bbab93266a39dc9f0e83a97af61ad18191f45c709e29b81c2214f7fbf4d4b04eecfe35dc49add84167e250d0
-
SSDEEP
6144:n0c3knldodUmC33e3sPaeBFSflE9tM3OwJki2zP0z+TzTj:0c3k2C3ykdwGRTr
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1916 70BD.tmp -
Loads dropped DLL 2 IoCs
pid Process 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\379.exe = "C:\\Program Files (x86)\\LP\\EC04\\379.exe" 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/2148-3-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/2148-13-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/1312-17-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/1312-19-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/2148-16-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2148-124-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/1364-128-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/1364-126-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/2148-303-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/2148-307-0x0000000000400000-0x0000000000469000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\EC04\379.exe 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\EC04\379.exe 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\EC04\70BD.tmp 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70BD.tmp -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1772 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe Token: SeSecurityPrivilege 2992 msiexec.exe Token: SeShutdownPrivilege 1772 explorer.exe Token: SeShutdownPrivilege 1772 explorer.exe Token: SeShutdownPrivilege 1772 explorer.exe Token: SeShutdownPrivilege 1772 explorer.exe Token: SeShutdownPrivilege 1772 explorer.exe Token: SeShutdownPrivilege 1772 explorer.exe Token: SeShutdownPrivilege 1772 explorer.exe Token: SeShutdownPrivilege 1772 explorer.exe Token: SeShutdownPrivilege 1772 explorer.exe Token: SeShutdownPrivilege 1772 explorer.exe Token: SeShutdownPrivilege 1772 explorer.exe Token: SeShutdownPrivilege 1772 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe 1772 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2148 wrote to memory of 1312 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 32 PID 2148 wrote to memory of 1312 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 32 PID 2148 wrote to memory of 1312 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 32 PID 2148 wrote to memory of 1312 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 32 PID 2148 wrote to memory of 1364 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 34 PID 2148 wrote to memory of 1364 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 34 PID 2148 wrote to memory of 1364 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 34 PID 2148 wrote to memory of 1364 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 34 PID 2148 wrote to memory of 1916 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 37 PID 2148 wrote to memory of 1916 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 37 PID 2148 wrote to memory of 1916 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 37 PID 2148 wrote to memory of 1916 2148 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe 37 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\4308C\6B1EC.exe%C:\Users\Admin\AppData\Roaming\4308C2⤵PID:1312
-
-
C:\Users\Admin\AppData\Local\Temp\4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\4a82471b1cdc5f3661b0d8c40f8046cd_JaffaCakes118.exe startC:\Program Files (x86)\8C7E4\lvvm.exe%C:\Program Files (x86)\8C7E42⤵PID:1364
-
-
C:\Program Files (x86)\LP\EC04\70BD.tmp"C:\Program Files (x86)\LP\EC04\70BD.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1916
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1772
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD58183bf8e4f9e040ccfb9c6df0e7bdbc0
SHA19805a0f12a94cdbec33ba9dc9f64468433f01baf
SHA25635fc658f129823175e5276b5828ebf7fe1f4e95b7aeddcd21069afa78843446e
SHA5122bb4ea285fea9b2d765e7d9af19816a730cf2e96b616844a85155448d9223cd7a95f49cd0576d228ad1cd3364cfc0c9b9c57c5126195982d79cb21d64e0a284b
-
Filesize
600B
MD50dfb601d3ee514e59ab212f93b270d39
SHA179e29d16020df01b2e6f00333d61557c906f2032
SHA256587d3d9ad2b04917bc7a260c35ae0abe0fca023430b1387205e7b65b9f4d6d77
SHA5123650fd251d9ba075e75559f22dd3363e1fb1a27b7dfe12a88b0762ff562afd8c3f279ed6712b90470b145841af68d1a69ab453a72ceb941b1219a962cbdd6dc1
-
Filesize
94KB
MD5357af328908353040840f79fd805c127
SHA1aa051df5c1e1d7a52e903532bb1353026bc8f942
SHA256334acfbe4cc54bf676308670e21cd742bae7e0a6f957f1564bc655fc2d3df3d0
SHA512c0d91065f2b12c7b5f80fea522d2668b29828e651ae4868ed0ffff2c217b91f416db8e60c8362fd2130e57e191c4aecab80b9756a6de3eb0a2371d80b266f851