Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-10-2024 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe
-
Size
934KB
-
MD5
5b35a109fa6c24e5f36aa539f21b0471
-
SHA1
7bd809e4a38ffefb07af941f2d642e190e116705
-
SHA256
230487fbc5f787ee4c0a01bd118962c86837aab4e49855e9c54603cace4711f2
-
SHA512
73b7a98fb2a2fe8345795dd8f8ebe134fea64a95a2217c49a2bc652128ef5ba33eff81b78cd754fbe9258a70147b83767dd64483d4ce7e8f702039c7b184576c
-
SSDEEP
12288:tMYIWfFq6mgOmJbJPTLUfkF1w8fbN3+J86FMSaJ/q3NSo76ZBvu6Yoa/TBiFrO+s:tX3CkF1w8T1+J86F/uq3Mo6ZYoatEy5
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Counter Strike Source MultiHack v1.8.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" Counter Strike Source MultiHack v1.8.exe -
Processes:
winupdate.exeexplorer.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Counter Strike Source MultiHack v1.8.exeexplorer.exewinupdate.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Counter Strike Source MultiHack v1.8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exeCounter Strike Source MultiHack v1.8.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Counter Strike Source MultiHack v1.8.exe -
Executes dropped EXE 2 IoCs
Processes:
Counter Strike Source MultiHack v1.8.exewinupdate.exepid Process 2860 Counter Strike Source MultiHack v1.8.exe 3964 winupdate.exe -
Processes:
winupdate.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Counter Strike Source MultiHack v1.8.exenotepad.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" Counter Strike Source MultiHack v1.8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" notepad.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Counter Strike Source MultiHack v1.8.exedescription pid Process procid_target PID 2860 set thread context of 3676 2860 Counter Strike Source MultiHack v1.8.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
winupdate.exenotepad.exeCounter Strike Source MultiHack v1.8.exenotepad.exeexplorer.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Counter Strike Source MultiHack v1.8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Counter Strike Source MultiHack v1.8.exeexplorer.exewinupdate.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Counter Strike Source MultiHack v1.8.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Counter Strike Source MultiHack v1.8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Counter Strike Source MultiHack v1.8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Counter Strike Source MultiHack v1.8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
explorer.exewinupdate.exeCounter Strike Source MultiHack v1.8.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Counter Strike Source MultiHack v1.8.exe -
Modifies registry class 1 IoCs
Processes:
5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid Process 4296 NOTEPAD.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Counter Strike Source MultiHack v1.8.exeexplorer.exewinupdate.exedescription pid Process Token: SeIncreaseQuotaPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeSecurityPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeTakeOwnershipPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeLoadDriverPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeSystemProfilePrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeSystemtimePrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeProfSingleProcessPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeIncBasePriorityPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeCreatePagefilePrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeBackupPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeRestorePrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeShutdownPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeDebugPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeSystemEnvironmentPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeChangeNotifyPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeRemoteShutdownPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeUndockPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeManageVolumePrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeImpersonatePrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: SeCreateGlobalPrivilege 2860 Counter Strike Source MultiHack v1.8.exe Token: 33 2860 Counter Strike Source MultiHack v1.8.exe Token: 34 2860 Counter Strike Source MultiHack v1.8.exe Token: 35 2860 Counter Strike Source MultiHack v1.8.exe Token: 36 2860 Counter Strike Source MultiHack v1.8.exe Token: SeIncreaseQuotaPrivilege 3676 explorer.exe Token: SeSecurityPrivilege 3676 explorer.exe Token: SeTakeOwnershipPrivilege 3676 explorer.exe Token: SeLoadDriverPrivilege 3676 explorer.exe Token: SeSystemProfilePrivilege 3676 explorer.exe Token: SeSystemtimePrivilege 3676 explorer.exe Token: SeProfSingleProcessPrivilege 3676 explorer.exe Token: SeIncBasePriorityPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeBackupPrivilege 3676 explorer.exe Token: SeRestorePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeDebugPrivilege 3676 explorer.exe Token: SeSystemEnvironmentPrivilege 3676 explorer.exe Token: SeChangeNotifyPrivilege 3676 explorer.exe Token: SeRemoteShutdownPrivilege 3676 explorer.exe Token: SeUndockPrivilege 3676 explorer.exe Token: SeManageVolumePrivilege 3676 explorer.exe Token: SeImpersonatePrivilege 3676 explorer.exe Token: SeCreateGlobalPrivilege 3676 explorer.exe Token: 33 3676 explorer.exe Token: 34 3676 explorer.exe Token: 35 3676 explorer.exe Token: 36 3676 explorer.exe Token: SeIncreaseQuotaPrivilege 3964 winupdate.exe Token: SeSecurityPrivilege 3964 winupdate.exe Token: SeTakeOwnershipPrivilege 3964 winupdate.exe Token: SeLoadDriverPrivilege 3964 winupdate.exe Token: SeSystemProfilePrivilege 3964 winupdate.exe Token: SeSystemtimePrivilege 3964 winupdate.exe Token: SeProfSingleProcessPrivilege 3964 winupdate.exe Token: SeIncBasePriorityPrivilege 3964 winupdate.exe Token: SeCreatePagefilePrivilege 3964 winupdate.exe Token: SeBackupPrivilege 3964 winupdate.exe Token: SeRestorePrivilege 3964 winupdate.exe Token: SeShutdownPrivilege 3964 winupdate.exe Token: SeDebugPrivilege 3964 winupdate.exe Token: SeSystemEnvironmentPrivilege 3964 winupdate.exe Token: SeChangeNotifyPrivilege 3964 winupdate.exe Token: SeRemoteShutdownPrivilege 3964 winupdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid Process 3676 explorer.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exeCounter Strike Source MultiHack v1.8.exeexplorer.exedescription pid Process procid_target PID 4504 wrote to memory of 4296 4504 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe 84 PID 4504 wrote to memory of 4296 4504 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe 84 PID 4504 wrote to memory of 2860 4504 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe 85 PID 4504 wrote to memory of 2860 4504 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe 85 PID 4504 wrote to memory of 2860 4504 5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe 85 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 4500 2860 Counter Strike Source MultiHack v1.8.exe 88 PID 2860 wrote to memory of 3676 2860 Counter Strike Source MultiHack v1.8.exe 89 PID 2860 wrote to memory of 3676 2860 Counter Strike Source MultiHack v1.8.exe 89 PID 2860 wrote to memory of 3676 2860 Counter Strike Source MultiHack v1.8.exe 89 PID 2860 wrote to memory of 3676 2860 Counter Strike Source MultiHack v1.8.exe 89 PID 2860 wrote to memory of 3676 2860 Counter Strike Source MultiHack v1.8.exe 89 PID 2860 wrote to memory of 3964 2860 Counter Strike Source MultiHack v1.8.exe 90 PID 2860 wrote to memory of 3964 2860 Counter Strike Source MultiHack v1.8.exe 90 PID 2860 wrote to memory of 3964 2860 Counter Strike Source MultiHack v1.8.exe 90 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92 PID 3676 wrote to memory of 1804 3676 explorer.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5b35a109fa6c24e5f36aa539f21b0471_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\README.txt2⤵
- Opens file in notepad (likely ransom note)
PID:4296
-
-
C:\Users\Admin\AppData\Local\Temp\Counter Strike Source MultiHack v1.8.exe"C:\Users\Admin\AppData\Local\Temp\Counter Strike Source MultiHack v1.8.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4500
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Windows security bypass
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe4⤵
- System Location Discovery: System Language Discovery
PID:1804
-
-
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"3⤵
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
679KB
MD51bb62291db3dd70c4e1b2e19531cc708
SHA1c2e5ef6a2dc2d948ffc319b2a09140557d49f67a
SHA256cbd86aa53612008d72b15db8e7a5a3ea8054f7dc15d7a40b0ac1359abd254905
SHA512acb830b6789d6ec89efd955f253cff1f6af92246bc206edaad19bff7299533ff636e3679dd0a41c7878f278885aa3bfe53897419de9c7c395ffc0cb58b958357
-
Filesize
64B
MD5c6a480daff6e999199dfbe6c46f66e11
SHA1192947450c2b5a8f70364247d6039db541f37408
SHA2564985900805411ee54cf34bd311b31d25f8ceb55fc0123f5ae1b60dab8adafe9c
SHA5128644c9dac2fc32d68879d7694964ca916e4f167538036bced2d1b5708f7a516b4ecf34cd87f26a054869a4058a8d5d8402129b27c75546db74fc1c17864ecd16