Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-10-2024 22:22
Static task
static1
Behavioral task
behavioral1
Sample
540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe
-
Size
128KB
-
MD5
540583f96e62385fd02eb7300062d7be
-
SHA1
48e628b085d6c22ac4caceeac3e0a2c97d9431c1
-
SHA256
777dfe8c30de4ea764095bba9ea1762d932457bd7564cdce0713ae8f58c5bdec
-
SHA512
ee1da166c023b83891f5270e083822889713d45361f22da16948bd07add30c3bb04f08ce1e1078c9e287d4ef01d0d41ca609973912b30c0a3170728faed57922
-
SSDEEP
1536:/514vVST27uuynw8P9xpdRGf4kVMjE1woL97tmfCk2urv5:h2vVSTayn/P9XupVio4fCklrv5
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "00000000" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "00000000" csrss.exe -
Deletes itself 1 IoCs
pid Process 2556 csrss.exe -
Executes dropped EXE 2 IoCs
pid Process 1020 smss.exe 2556 csrss.exe -
Loads dropped DLL 4 IoCs
pid Process 2856 Script_102234.exe 2856 Script_102234.exe 1020 smss.exe 1020 smss.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cttmon.exe = "C:\\WINDOWS\\system32\\cttmon.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cttmon.exe = "C:\\WINDOWS\\system32\\cttmon.exe" csrss.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: smss.exe File opened (read-only) \??\H: smss.exe File opened (read-only) \??\I: smss.exe File opened (read-only) \??\J: smss.exe File opened (read-only) \??\L: smss.exe File opened (read-only) \??\M: smss.exe File opened (read-only) \??\N: smss.exe File opened (read-only) \??\E: smss.exe File opened (read-only) \??\G: smss.exe File opened (read-only) \??\S: smss.exe File opened (read-only) \??\O: smss.exe File opened (read-only) \??\Q: smss.exe File opened (read-only) \??\R: smss.exe File opened (read-only) \??\U: smss.exe File opened (read-only) \??\W: smss.exe File opened (read-only) \??\Z: smss.exe File opened (read-only) \??\K: smss.exe File opened (read-only) \??\T: smss.exe File opened (read-only) \??\V: smss.exe File opened (read-only) \??\X: smss.exe File opened (read-only) \??\Y: smss.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\c:\autorun.inf smss.exe File opened for modification \??\c:\autorun.inf smss.exe File created \??\f:\autorun.inf smss.exe File opened for modification \??\f:\autorun.inf smss.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\cttmon.exe smss.exe File opened for modification \??\c:\windows\SysWOW64\cttmon.exe smss.exe File created \??\c:\windows\SysWOW64\dxdiagupdt.exe smss.exe File opened for modification \??\c:\windows\SysWOW64\dxdiagupdt.exe smss.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Temporary downloads\Active scritps\{89756EC-89913CB-00F1CE}-TIP\Script_102234.exe csrss.exe File opened for modification C:\Program Files\Temporary downloads\Active scritps\{89756EC-89913CB-00F1CE}-TIP\ csrss.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script_102234.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1020 smss.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1632 540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1632 540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe 2856 Script_102234.exe 1020 smss.exe 1020 smss.exe 2556 csrss.exe 2556 csrss.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1632 wrote to memory of 2856 1632 540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe 28 PID 1632 wrote to memory of 2856 1632 540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe 28 PID 1632 wrote to memory of 2856 1632 540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe 28 PID 1632 wrote to memory of 2856 1632 540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe 28 PID 2856 wrote to memory of 1020 2856 Script_102234.exe 29 PID 2856 wrote to memory of 1020 2856 Script_102234.exe 29 PID 2856 wrote to memory of 1020 2856 Script_102234.exe 29 PID 2856 wrote to memory of 1020 2856 Script_102234.exe 29 PID 1020 wrote to memory of 2556 1020 smss.exe 31 PID 1020 wrote to memory of 2556 1020 smss.exe 31 PID 1020 wrote to memory of 2556 1020 smss.exe 31 PID 1020 wrote to memory of 2556 1020 smss.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Program Files\Temporary downloads\Active scritps\{89756EC-89913CB-00F1CE}-TIP\Script_102234.exe"C:\Program Files\Temporary downloads\Active scritps\{89756EC-89913CB-00F1CE}-TIP\Script_102234.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\RECYCLER\S-1-5-21-2847125355-358004884-1566868893-1122\smss.exe"C:\RECYCLER\S-1-5-21-2847125355-358004884-1566868893-1122\smss.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\recycler\S-1-5-21-2847125355-358004884-1566868893-1122\csrss.exe"C:\recycler\S-1-5-21-2847125355-358004884-1566868893-1122\csrss.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2556
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD5540583f96e62385fd02eb7300062d7be
SHA148e628b085d6c22ac4caceeac3e0a2c97d9431c1
SHA256777dfe8c30de4ea764095bba9ea1762d932457bd7564cdce0713ae8f58c5bdec
SHA512ee1da166c023b83891f5270e083822889713d45361f22da16948bd07add30c3bb04f08ce1e1078c9e287d4ef01d0d41ca609973912b30c0a3170728faed57922