Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
89c742b35826d51946f74631288c1171_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
89c742b35826d51946f74631288c1171_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
89c742b35826d51946f74631288c1171_JaffaCakes118.exe
-
Size
3.4MB
-
MD5
89c742b35826d51946f74631288c1171
-
SHA1
8ea9f21f502a5af0143e363b0d05e74ffeef638d
-
SHA256
01ca2ff67af9d0c5881b6936157e9fbe697ea05174847a565ffc1c9b062a5b0a
-
SHA512
f1a09dd21c9b7527191d511341d05528e2a8c31494db86307943ae8efff4f1b0eb93cf70b08baf83e353b5e353c2bffd59702ef02d473ed0793d49a82914f9c9
-
SSDEEP
49152:d/xDnN4g3oFI/6OeutxOtkNs3UeJS6Rth+oqSOd+z7CvSCxgywSlgkvTj6YtR:d5FYi/6DKOt0qtJ3hvDwxZ91v3t
Malware Config
Signatures
-
Uses Session Manager for persistence 2 TTPs 3 IoCs
Creates Session Manager registry key to run executable early in system boot.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win = "C:\\win.exe" 89c742b35826d51946f74631288c1171_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\reg_0001.txt 89c742b35826d51946f74631288c1171_JaffaCakes118.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1696 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89c742b35826d51946f74631288c1171_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1124 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3288 wrote to memory of 1124 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 84 PID 3288 wrote to memory of 1124 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 84 PID 3288 wrote to memory of 1124 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 84 PID 3288 wrote to memory of 1696 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 85 PID 3288 wrote to memory of 1696 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 85 PID 3288 wrote to memory of 1696 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 85 PID 3288 wrote to memory of 448 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 86 PID 3288 wrote to memory of 448 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 86 PID 3288 wrote to memory of 448 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 86 PID 3288 wrote to memory of 4560 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 87 PID 3288 wrote to memory of 4560 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 87 PID 3288 wrote to memory of 4560 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 87 PID 3288 wrote to memory of 4556 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 88 PID 3288 wrote to memory of 4556 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 88 PID 3288 wrote to memory of 4556 3288 89c742b35826d51946f74631288c1171_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1124
-
-
C:\Windows\SysWOW64\sc.exesc delete GbpSv2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1696
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
- System Location Discovery: System Language Discovery
PID:448
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
- System Location Discovery: System Language Discovery
PID:4560
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
- System Location Discovery: System Language Discovery
PID:4556
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1