Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-10-2024 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe
-
Size
934KB
-
MD5
5b35a109fa6c24e5f36aa539f21b0471
-
SHA1
7bd809e4a38ffefb07af941f2d642e190e116705
-
SHA256
230487fbc5f787ee4c0a01bd118962c86837aab4e49855e9c54603cace4711f2
-
SHA512
73b7a98fb2a2fe8345795dd8f8ebe134fea64a95a2217c49a2bc652128ef5ba33eff81b78cd754fbe9258a70147b83767dd64483d4ce7e8f702039c7b184576c
-
SSDEEP
12288:tMYIWfFq6mgOmJbJPTLUfkF1w8fbN3+J86FMSaJ/q3NSo76ZBvu6Yoa/TBiFrO+s:tX3CkF1w8T1+J86F/uq3Mo6ZYoatEy5
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Counter Strike Source MultiHack v1.8.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" Counter Strike Source MultiHack v1.8.exe -
Processes:
explorer.exewinupdate.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exewinupdate.exeCounter Strike Source MultiHack v1.8.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Counter Strike Source MultiHack v1.8.exe -
Executes dropped EXE 2 IoCs
Processes:
Counter Strike Source MultiHack v1.8.exewinupdate.exepid Process 2540 Counter Strike Source MultiHack v1.8.exe 2720 winupdate.exe -
Loads dropped DLL 4 IoCs
Processes:
Counter Strike Source MultiHack v1.8.exewinupdate.exepid Process 2540 Counter Strike Source MultiHack v1.8.exe 2720 winupdate.exe 2720 winupdate.exe 2720 winupdate.exe -
Processes:
winupdate.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Counter Strike Source MultiHack v1.8.exenotepad.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" Counter Strike Source MultiHack v1.8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" notepad.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Counter Strike Source MultiHack v1.8.exedescription pid Process procid_target PID 2540 set thread context of 2628 2540 Counter Strike Source MultiHack v1.8.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Counter Strike Source MultiHack v1.8.exenotepad.exeexplorer.exewinupdate.exenotepad.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Counter Strike Source MultiHack v1.8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
winupdate.exeCounter Strike Source MultiHack v1.8.exeexplorer.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Counter Strike Source MultiHack v1.8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Counter Strike Source MultiHack v1.8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Counter Strike Source MultiHack v1.8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Counter Strike Source MultiHack v1.8.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
Counter Strike Source MultiHack v1.8.exeexplorer.exewinupdate.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Counter Strike Source MultiHack v1.8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid Process 1040 NOTEPAD.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Counter Strike Source MultiHack v1.8.exeexplorer.exewinupdate.exedescription pid Process Token: SeIncreaseQuotaPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeSecurityPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeTakeOwnershipPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeLoadDriverPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeSystemProfilePrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeSystemtimePrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeProfSingleProcessPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeIncBasePriorityPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeCreatePagefilePrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeBackupPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeRestorePrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeShutdownPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeDebugPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeSystemEnvironmentPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeChangeNotifyPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeRemoteShutdownPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeUndockPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeManageVolumePrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeImpersonatePrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: SeCreateGlobalPrivilege 2540 Counter Strike Source MultiHack v1.8.exe Token: 33 2540 Counter Strike Source MultiHack v1.8.exe Token: 34 2540 Counter Strike Source MultiHack v1.8.exe Token: 35 2540 Counter Strike Source MultiHack v1.8.exe Token: SeIncreaseQuotaPrivilege 2628 explorer.exe Token: SeSecurityPrivilege 2628 explorer.exe Token: SeTakeOwnershipPrivilege 2628 explorer.exe Token: SeLoadDriverPrivilege 2628 explorer.exe Token: SeSystemProfilePrivilege 2628 explorer.exe Token: SeSystemtimePrivilege 2628 explorer.exe Token: SeProfSingleProcessPrivilege 2628 explorer.exe Token: SeIncBasePriorityPrivilege 2628 explorer.exe Token: SeCreatePagefilePrivilege 2628 explorer.exe Token: SeBackupPrivilege 2628 explorer.exe Token: SeRestorePrivilege 2628 explorer.exe Token: SeShutdownPrivilege 2628 explorer.exe Token: SeDebugPrivilege 2628 explorer.exe Token: SeSystemEnvironmentPrivilege 2628 explorer.exe Token: SeChangeNotifyPrivilege 2628 explorer.exe Token: SeRemoteShutdownPrivilege 2628 explorer.exe Token: SeUndockPrivilege 2628 explorer.exe Token: SeManageVolumePrivilege 2628 explorer.exe Token: SeImpersonatePrivilege 2628 explorer.exe Token: SeCreateGlobalPrivilege 2628 explorer.exe Token: 33 2628 explorer.exe Token: 34 2628 explorer.exe Token: 35 2628 explorer.exe Token: SeIncreaseQuotaPrivilege 2720 winupdate.exe Token: SeSecurityPrivilege 2720 winupdate.exe Token: SeTakeOwnershipPrivilege 2720 winupdate.exe Token: SeLoadDriverPrivilege 2720 winupdate.exe Token: SeSystemProfilePrivilege 2720 winupdate.exe Token: SeSystemtimePrivilege 2720 winupdate.exe Token: SeProfSingleProcessPrivilege 2720 winupdate.exe Token: SeIncBasePriorityPrivilege 2720 winupdate.exe Token: SeCreatePagefilePrivilege 2720 winupdate.exe Token: SeBackupPrivilege 2720 winupdate.exe Token: SeRestorePrivilege 2720 winupdate.exe Token: SeShutdownPrivilege 2720 winupdate.exe Token: SeDebugPrivilege 2720 winupdate.exe Token: SeSystemEnvironmentPrivilege 2720 winupdate.exe Token: SeChangeNotifyPrivilege 2720 winupdate.exe Token: SeRemoteShutdownPrivilege 2720 winupdate.exe Token: SeUndockPrivilege 2720 winupdate.exe Token: SeManageVolumePrivilege 2720 winupdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid Process 2628 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exeCounter Strike Source MultiHack v1.8.exeexplorer.exedescription pid Process procid_target PID 3048 wrote to memory of 1040 3048 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe 30 PID 3048 wrote to memory of 1040 3048 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe 30 PID 3048 wrote to memory of 1040 3048 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe 30 PID 3048 wrote to memory of 2540 3048 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe 31 PID 3048 wrote to memory of 2540 3048 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe 31 PID 3048 wrote to memory of 2540 3048 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe 31 PID 3048 wrote to memory of 2540 3048 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe 31 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2264 2540 Counter Strike Source MultiHack v1.8.exe 32 PID 2540 wrote to memory of 2628 2540 Counter Strike Source MultiHack v1.8.exe 33 PID 2540 wrote to memory of 2628 2540 Counter Strike Source MultiHack v1.8.exe 33 PID 2540 wrote to memory of 2628 2540 Counter Strike Source MultiHack v1.8.exe 33 PID 2540 wrote to memory of 2628 2540 Counter Strike Source MultiHack v1.8.exe 33 PID 2540 wrote to memory of 2628 2540 Counter Strike Source MultiHack v1.8.exe 33 PID 2540 wrote to memory of 2628 2540 Counter Strike Source MultiHack v1.8.exe 33 PID 2540 wrote to memory of 2720 2540 Counter Strike Source MultiHack v1.8.exe 34 PID 2540 wrote to memory of 2720 2540 Counter Strike Source MultiHack v1.8.exe 34 PID 2540 wrote to memory of 2720 2540 Counter Strike Source MultiHack v1.8.exe 34 PID 2540 wrote to memory of 2720 2540 Counter Strike Source MultiHack v1.8.exe 34 PID 2540 wrote to memory of 2720 2540 Counter Strike Source MultiHack v1.8.exe 34 PID 2540 wrote to memory of 2720 2540 Counter Strike Source MultiHack v1.8.exe 34 PID 2540 wrote to memory of 2720 2540 Counter Strike Source MultiHack v1.8.exe 34 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35 PID 2628 wrote to memory of 2728 2628 explorer.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\README.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1040
-
-
C:\Users\Admin\AppData\Local\Temp\Counter Strike Source MultiHack v1.8.exe"C:\Users\Admin\AppData\Local\Temp\Counter Strike Source MultiHack v1.8.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2264
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Windows security bypass
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe4⤵
- System Location Discovery: System Language Discovery
PID:2728
-
-
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"3⤵
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
679KB
MD51bb62291db3dd70c4e1b2e19531cc708
SHA1c2e5ef6a2dc2d948ffc319b2a09140557d49f67a
SHA256cbd86aa53612008d72b15db8e7a5a3ea8054f7dc15d7a40b0ac1359abd254905
SHA512acb830b6789d6ec89efd955f253cff1f6af92246bc206edaad19bff7299533ff636e3679dd0a41c7878f278885aa3bfe53897419de9c7c395ffc0cb58b958357
-
Filesize
64B
MD5c6a480daff6e999199dfbe6c46f66e11
SHA1192947450c2b5a8f70364247d6039db541f37408
SHA2564985900805411ee54cf34bd311b31d25f8ceb55fc0123f5ae1b60dab8adafe9c
SHA5128644c9dac2fc32d68879d7694964ca916e4f167538036bced2d1b5708f7a516b4ecf34cd87f26a054869a4058a8d5d8402129b27c75546db74fc1c17864ecd16