Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe
-
Size
32KB
-
MD5
8378669bb680e8f9f1b119af478bd7f1
-
SHA1
5451fd915ff5c3a89a4c003e55122cd94fe985a5
-
SHA256
dcff17166a640b9230c5bc8f0eeeec4160f3f4ffff09e430a010c7d8ab67fc54
-
SHA512
edffe6511ea44485664cc553ab658b103fc5d012cbf8a94ef2759fc3f59ed6fcdbaf088617352645984d13eb2e1d8d737d2573e7e97befcc641f93b395ae32a9
-
SSDEEP
768:7DpPPPPPf1nCl0cUl4VFINpZWq+HfB8sWZ3U2xrPaaTOKtBbC:7DpPPPPPfQ0ZoIlAHkZEyrPaaTO+h
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4780 wuaucldt.exe 3964 wuaucldt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\windows\\system32\\wuaucldt.exe" wuaucldt.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\users\\admin\\wuaucldt.exe" wuaucldt.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\wuaucldt.exe 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\wuaucldt.exe wuaucldt.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3964 set thread context of 2244 3964 wuaucldt.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuaucldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuaucldt.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1248 wrote to memory of 4780 1248 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 85 PID 1248 wrote to memory of 4780 1248 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 85 PID 1248 wrote to memory of 4780 1248 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 85 PID 4780 wrote to memory of 3964 4780 wuaucldt.exe 87 PID 4780 wrote to memory of 3964 4780 wuaucldt.exe 87 PID 4780 wrote to memory of 3964 4780 wuaucldt.exe 87 PID 3964 wrote to memory of 2244 3964 wuaucldt.exe 88 PID 3964 wrote to memory of 2244 3964 wuaucldt.exe 88 PID 3964 wrote to memory of 2244 3964 wuaucldt.exe 88 PID 3964 wrote to memory of 2244 3964 wuaucldt.exe 88 PID 3964 wrote to memory of 2244 3964 wuaucldt.exe 88 PID 1248 wrote to memory of 3480 1248 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 93 PID 1248 wrote to memory of 3480 1248 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 93 PID 1248 wrote to memory of 3480 1248 8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe 93 PID 4780 wrote to memory of 3752 4780 wuaucldt.exe 95 PID 4780 wrote to memory of 3752 4780 wuaucldt.exe 95 PID 4780 wrote to memory of 3752 4780 wuaucldt.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8378669bb680e8f9f1b119af478bd7f1_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\windows\SysWOW64\wuaucldt.exec:\windows\system32\wuaucldt.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\users\admin\wuaucldt.exec:\users\admin\wuaucldt.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:2244
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\windows\syswow64\wuaucldt.exe3⤵
- System Location Discovery: System Language Discovery
PID:3752
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\users\admin\appdata\local\temp\837866~1.EXE2⤵
- System Location Discovery: System Language Discovery
PID:3480
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD58378669bb680e8f9f1b119af478bd7f1
SHA15451fd915ff5c3a89a4c003e55122cd94fe985a5
SHA256dcff17166a640b9230c5bc8f0eeeec4160f3f4ffff09e430a010c7d8ab67fc54
SHA512edffe6511ea44485664cc553ab658b103fc5d012cbf8a94ef2759fc3f59ed6fcdbaf088617352645984d13eb2e1d8d737d2573e7e97befcc641f93b395ae32a9