Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe
-
Size
32KB
-
MD5
8378669bb680e8f9f1b119af478bd7f1
-
SHA1
5451fd915ff5c3a89a4c003e55122cd94fe985a5
-
SHA256
dcff17166a640b9230c5bc8f0eeeec4160f3f4ffff09e430a010c7d8ab67fc54
-
SHA512
edffe6511ea44485664cc553ab658b103fc5d012cbf8a94ef2759fc3f59ed6fcdbaf088617352645984d13eb2e1d8d737d2573e7e97befcc641f93b395ae32a9
-
SSDEEP
768:7DpPPPPPf1nCl0cUl4VFINpZWq+HfB8sWZ3U2xrPaaTOKtBbC:7DpPPPPPfQ0ZoIlAHkZEyrPaaTO+h
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2376 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2556 wuaucldt.exe 2492 wuaucldt.exe -
Loads dropped DLL 4 IoCs
pid Process 2280 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 2280 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 2556 wuaucldt.exe 2556 wuaucldt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\windows\\system32\\wuaucldt.exe" wuaucldt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\users\\admin\\wuaucldt.exe" wuaucldt.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\wuaucldt.exe 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\wuaucldt.exe wuaucldt.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2492 set thread context of 3044 2492 wuaucldt.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuaucldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuaucldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2556 2280 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2556 2280 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2556 2280 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2556 2280 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 31 PID 2556 wrote to memory of 2492 2556 wuaucldt.exe 32 PID 2556 wrote to memory of 2492 2556 wuaucldt.exe 32 PID 2556 wrote to memory of 2492 2556 wuaucldt.exe 32 PID 2556 wrote to memory of 2492 2556 wuaucldt.exe 32 PID 2492 wrote to memory of 3044 2492 wuaucldt.exe 33 PID 2492 wrote to memory of 3044 2492 wuaucldt.exe 33 PID 2492 wrote to memory of 3044 2492 wuaucldt.exe 33 PID 2492 wrote to memory of 3044 2492 wuaucldt.exe 33 PID 2492 wrote to memory of 3044 2492 wuaucldt.exe 33 PID 2492 wrote to memory of 3044 2492 wuaucldt.exe 33 PID 2280 wrote to memory of 2376 2280 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 34 PID 2280 wrote to memory of 2376 2280 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 34 PID 2280 wrote to memory of 2376 2280 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 34 PID 2280 wrote to memory of 2376 2280 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 34 PID 2556 wrote to memory of 2296 2556 wuaucldt.exe 36 PID 2556 wrote to memory of 2296 2556 wuaucldt.exe 36 PID 2556 wrote to memory of 2296 2556 wuaucldt.exe 36 PID 2556 wrote to memory of 2296 2556 wuaucldt.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\windows\SysWOW64\wuaucldt.exec:\windows\system32\wuaucldt.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\users\admin\wuaucldt.exec:\users\admin\wuaucldt.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:3044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\windows\syswow64\wuaucldt.exe3⤵
- System Location Discovery: System Language Discovery
PID:2296
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\users\admin\appdata\local\temp\837866~1.EXE2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2376
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD58378669bb680e8f9f1b119af478bd7f1
SHA15451fd915ff5c3a89a4c003e55122cd94fe985a5
SHA256dcff17166a640b9230c5bc8f0eeeec4160f3f4ffff09e430a010c7d8ab67fc54
SHA512edffe6511ea44485664cc553ab658b103fc5d012cbf8a94ef2759fc3f59ed6fcdbaf088617352645984d13eb2e1d8d737d2573e7e97befcc641f93b395ae32a9