Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2024 08:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
21 signatures
150 seconds
General
-
Target
69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe
-
Size
986KB
-
MD5
69b1f8ff1e49b78c12fa6657cdef2017
-
SHA1
a6a9eaa541afbf63dbe34e14b39c50f6c89fda14
-
SHA256
01b69d1f321f028ced66f438204789ef1327aa7fd69619b5840994362fb50510
-
SHA512
15875b5ee05a797fdb6a298c8b558b7d4855d9f715bdbda85236ac55aa34128a22b64d0eb683393aa371d744f956f59682b6120abb809f6eac9bf5c86632cb15
-
SSDEEP
24576:w+UD04MRHFqK4VST/xVXJ9k2Ni3n8qcQ6fySiI:f4MRHF6VWxFvkcikQ1DI
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\system32\\winlogon.exe" 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
winlogon.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" winlogon.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile winlogon.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" winlogon.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
winlogon.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" winlogon.exe -
Processes:
winlogon.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winlogon.exe -
Disables Task Manager via registry modification
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exewinlogon.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winlogon.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
winlogon.exewinlogon.exepid Process 5040 winlogon.exe 4568 winlogon.exe -
Processes:
winlogon.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winlogon.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\system32\\winlogon.exe" 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exewinlogon.exedescription pid Process procid_target PID 4036 set thread context of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 5040 set thread context of 4568 5040 winlogon.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exewinlogon.exewinlogon.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exewinlogon.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winlogon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winlogon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winlogon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winlogon.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exewinlogon.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winlogon.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
winlogon.exepid Process 4568 winlogon.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exewinlogon.exedescription pid Process Token: SeIncreaseQuotaPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeSecurityPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeSystemtimePrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeBackupPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeRestorePrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeShutdownPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeDebugPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeUndockPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeManageVolumePrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeImpersonatePrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: 33 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: 34 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: 35 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: 36 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 4568 winlogon.exe Token: SeSecurityPrivilege 4568 winlogon.exe Token: SeTakeOwnershipPrivilege 4568 winlogon.exe Token: SeLoadDriverPrivilege 4568 winlogon.exe Token: SeSystemProfilePrivilege 4568 winlogon.exe Token: SeSystemtimePrivilege 4568 winlogon.exe Token: SeProfSingleProcessPrivilege 4568 winlogon.exe Token: SeIncBasePriorityPrivilege 4568 winlogon.exe Token: SeCreatePagefilePrivilege 4568 winlogon.exe Token: SeBackupPrivilege 4568 winlogon.exe Token: SeRestorePrivilege 4568 winlogon.exe Token: SeShutdownPrivilege 4568 winlogon.exe Token: SeDebugPrivilege 4568 winlogon.exe Token: SeSystemEnvironmentPrivilege 4568 winlogon.exe Token: SeChangeNotifyPrivilege 4568 winlogon.exe Token: SeRemoteShutdownPrivilege 4568 winlogon.exe Token: SeUndockPrivilege 4568 winlogon.exe Token: SeManageVolumePrivilege 4568 winlogon.exe Token: SeImpersonatePrivilege 4568 winlogon.exe Token: SeCreateGlobalPrivilege 4568 winlogon.exe Token: 33 4568 winlogon.exe Token: 34 4568 winlogon.exe Token: 35 4568 winlogon.exe Token: 36 4568 winlogon.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exewinlogon.exewinlogon.exepid Process 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 5040 winlogon.exe 4568 winlogon.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exewinlogon.exedescription pid Process procid_target PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4036 wrote to memory of 4852 4036 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 84 PID 4852 wrote to memory of 5040 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 94 PID 4852 wrote to memory of 5040 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 94 PID 4852 wrote to memory of 5040 4852 69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe 94 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 PID 5040 wrote to memory of 4568 5040 winlogon.exe 95 -
System policy modification 1 TTPs 3 IoCs
Processes:
winlogon.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" winlogon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\69b1f8ff1e49b78c12fa6657cdef2017_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\system32\winlogon.exe"C:\system32\winlogon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\system32\winlogon.exeC:\system32\winlogon.exe4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4568
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
986KB
MD569b1f8ff1e49b78c12fa6657cdef2017
SHA1a6a9eaa541afbf63dbe34e14b39c50f6c89fda14
SHA25601b69d1f321f028ced66f438204789ef1327aa7fd69619b5840994362fb50510
SHA51215875b5ee05a797fdb6a298c8b558b7d4855d9f715bdbda85236ac55aa34128a22b64d0eb683393aa371d744f956f59682b6120abb809f6eac9bf5c86632cb15