Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-10-2024 02:20
Static task
static1
Behavioral task
behavioral1
Sample
6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
6873cbc43eb2744035978b4ab6c748a0
-
SHA1
f1a444ed188e974d4c4ada2754a672e986a74557
-
SHA256
ac4c799664c65e33c1cb19c183faadba788c0d299b9647c4b890e388fe3202b5
-
SHA512
5fa49323134c66549db5fc75c87ae8a6a3a69235d3175ebddc5bbc78fe6264bcb38a713a60f011201415cd72fb93f9257a3f866e29d3a73de43d94a772dbb6b1
-
SSDEEP
24576:3e/OhglHQEgBM4RsioUYpbNejT1C6H+e6UGwji:3yO45i/o6HLjji
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid Process 2868 attrib.exe 1808 attrib.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid Process 2860 msdcsc.exe -
Loads dropped DLL 1 IoCs
Processes:
vbc.exepid Process 2644 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exedescription pid Process procid_target PID 2296 set thread context of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 -
Drops file in Windows directory 2 IoCs
Processes:
attrib.exeattrib.exedescription ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exevbc.execmd.execmd.exeattrib.exeattrib.exemsdcsc.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
vbc.exedescription pid Process Token: SeIncreaseQuotaPrivilege 2644 vbc.exe Token: SeSecurityPrivilege 2644 vbc.exe Token: SeTakeOwnershipPrivilege 2644 vbc.exe Token: SeLoadDriverPrivilege 2644 vbc.exe Token: SeSystemProfilePrivilege 2644 vbc.exe Token: SeSystemtimePrivilege 2644 vbc.exe Token: SeProfSingleProcessPrivilege 2644 vbc.exe Token: SeIncBasePriorityPrivilege 2644 vbc.exe Token: SeCreatePagefilePrivilege 2644 vbc.exe Token: SeBackupPrivilege 2644 vbc.exe Token: SeRestorePrivilege 2644 vbc.exe Token: SeShutdownPrivilege 2644 vbc.exe Token: SeDebugPrivilege 2644 vbc.exe Token: SeSystemEnvironmentPrivilege 2644 vbc.exe Token: SeChangeNotifyPrivilege 2644 vbc.exe Token: SeRemoteShutdownPrivilege 2644 vbc.exe Token: SeUndockPrivilege 2644 vbc.exe Token: SeManageVolumePrivilege 2644 vbc.exe Token: SeImpersonatePrivilege 2644 vbc.exe Token: SeCreateGlobalPrivilege 2644 vbc.exe Token: 33 2644 vbc.exe Token: 34 2644 vbc.exe Token: 35 2644 vbc.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exevbc.execmd.execmd.exedescription pid Process procid_target PID 2296 wrote to memory of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2644 2296 6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe 30 PID 2644 wrote to memory of 2696 2644 vbc.exe 31 PID 2644 wrote to memory of 2696 2644 vbc.exe 31 PID 2644 wrote to memory of 2696 2644 vbc.exe 31 PID 2644 wrote to memory of 2696 2644 vbc.exe 31 PID 2644 wrote to memory of 2808 2644 vbc.exe 32 PID 2644 wrote to memory of 2808 2644 vbc.exe 32 PID 2644 wrote to memory of 2808 2644 vbc.exe 32 PID 2644 wrote to memory of 2808 2644 vbc.exe 32 PID 2696 wrote to memory of 2868 2696 cmd.exe 35 PID 2696 wrote to memory of 2868 2696 cmd.exe 35 PID 2696 wrote to memory of 2868 2696 cmd.exe 35 PID 2696 wrote to memory of 2868 2696 cmd.exe 35 PID 2808 wrote to memory of 1808 2808 cmd.exe 36 PID 2808 wrote to memory of 1808 2808 cmd.exe 36 PID 2808 wrote to memory of 1808 2808 cmd.exe 36 PID 2808 wrote to memory of 1808 2808 cmd.exe 36 PID 2644 wrote to memory of 2860 2644 vbc.exe 37 PID 2644 wrote to memory of 2860 2644 vbc.exe 37 PID 2644 wrote to memory of 2860 2644 vbc.exe 37 PID 2644 wrote to memory of 2860 2644 vbc.exe 37 -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid Process 2868 attrib.exe 1808 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6873cbc43eb2744035978b4ab6c748a0_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2868
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1808
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98