Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 02:34
Static task
static1
Behavioral task
behavioral1
Sample
8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe
-
Size
34KB
-
MD5
8eb67cc734a875679254c4ab019c1da7
-
SHA1
df84fa512b2f53ee908b2828ddff2d04906c3620
-
SHA256
591665d69fcf39fd137dbf179dd56a564e2b8b83ad1db69c9ee53515e3098992
-
SHA512
f6cd6dcb76ea2e502a49b97967cd6503973222d0dcd1541c89b9d8b48126ee1465774e535628550cbcaee3e024e4a9f7d8e9090fce2ec7701053a6e6e984e1c5
-
SSDEEP
768:KPfP6rwS1dPz4F1V46Alh3PSh0/1WBXXKE:KPfCrwS1d74FIfn3PSh0EBXXp
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\ProgramData\\SystemRoot.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 308 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DisplaySwitch = "\"C:\\ProgramData\\SystemRoot.exe\"" svchost.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe 308 svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2136 8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe 2136 8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2136 8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2136 8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2136 wrote to memory of 308 2136 8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe 31 PID 2136 wrote to memory of 308 2136 8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe 31 PID 2136 wrote to memory of 308 2136 8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe 31 PID 2136 wrote to memory of 308 2136 8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8eb67cc734a875679254c4ab019c1da7_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Modifies WinLogon for persistence
- Deletes itself
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:308
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1