Analysis
-
max time kernel
3s -
max time network
5s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 20:34
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4373196495fd5bd61a3ca0dd086b415d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_4373196495fd5bd61a3ca0dd086b415d.exe
Resource
win10v2004-20241007-en
Errors
General
-
Target
JaffaCakes118_4373196495fd5bd61a3ca0dd086b415d.exe
-
Size
344KB
-
MD5
4373196495fd5bd61a3ca0dd086b415d
-
SHA1
7e80f5e068643383fc29991333a23608ed322976
-
SHA256
ba531df27744b17a0006cda3da7751903ad9354cb5740c41a35913df05be0830
-
SHA512
8576c0301afa4780e1637ba40fddba2c20075122273d7c95831ff782d2359c842e8e41066b1202937baefeff833b1163da1b883255bb0d81c940d817dc8ad7a8
-
SSDEEP
6144:rlwEIOLQRCQ5Af7kkAsntTQubE1/K5blopzcbbw:rloDRCQMNAstTQajopf
Malware Config
Signatures
-
Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs
pid Process 5000 bcdedit.exe 2428 bcdedit.exe 4428 bcdedit.exe 772 bcdedit.exe 3512 bcdedit.exe 2948 bcdedit.exe 2896 bcdedit.exe 1396 bcdedit.exe 2292 bcdedit.exe 3592 bcdedit.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\e57925d.sys syshost.exe -
Enables test signing to bypass driver trust controls 1 TTPs 10 IoCs
Allows any signed driver to load without validation against a trusted certificate authority.
pid Process 5000 bcdedit.exe 2428 bcdedit.exe 4428 bcdedit.exe 772 bcdedit.exe 2896 bcdedit.exe 3512 bcdedit.exe 2948 bcdedit.exe 1396 bcdedit.exe 2292 bcdedit.exe 3592 bcdedit.exe -
Executes dropped EXE 1 IoCs
pid Process 4912 syshost.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Installer\{D18F138F-C729-DB54-1DF8-4545FDD7D2F7}\syshost.exe JaffaCakes118_4373196495fd5bd61a3ca0dd086b415d.exe File opened for modification C:\Windows\Installer\{D18F138F-C729-DB54-1DF8-4545FDD7D2F7}\syshost.exe JaffaCakes118_4373196495fd5bd61a3ca0dd086b415d.exe File opened for modification C:\Windows\Installer\{D18F138F-C729-DB54-1DF8-4545FDD7D2F7}\syshost.exe.tmp syshost.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_4373196495fd5bd61a3ca0dd086b415d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syshost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "157" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 652 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3428 JaffaCakes118_4373196495fd5bd61a3ca0dd086b415d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 4912 syshost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2296 LogonUI.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3428 wrote to memory of 1652 3428 JaffaCakes118_4373196495fd5bd61a3ca0dd086b415d.exe 85 PID 3428 wrote to memory of 1652 3428 JaffaCakes118_4373196495fd5bd61a3ca0dd086b415d.exe 85 PID 3428 wrote to memory of 1652 3428 JaffaCakes118_4373196495fd5bd61a3ca0dd086b415d.exe 85 PID 4912 wrote to memory of 5000 4912 syshost.exe 86 PID 4912 wrote to memory of 5000 4912 syshost.exe 86 PID 4912 wrote to memory of 3592 4912 syshost.exe 87 PID 4912 wrote to memory of 3592 4912 syshost.exe 87 PID 4912 wrote to memory of 2292 4912 syshost.exe 88 PID 4912 wrote to memory of 2292 4912 syshost.exe 88 PID 4912 wrote to memory of 1396 4912 syshost.exe 89 PID 4912 wrote to memory of 1396 4912 syshost.exe 89 PID 4912 wrote to memory of 2896 4912 syshost.exe 90 PID 4912 wrote to memory of 2896 4912 syshost.exe 90 PID 4912 wrote to memory of 2948 4912 syshost.exe 91 PID 4912 wrote to memory of 2948 4912 syshost.exe 91 PID 4912 wrote to memory of 3512 4912 syshost.exe 92 PID 4912 wrote to memory of 3512 4912 syshost.exe 92 PID 4912 wrote to memory of 772 4912 syshost.exe 93 PID 4912 wrote to memory of 772 4912 syshost.exe 93 PID 4912 wrote to memory of 4428 4912 syshost.exe 94 PID 4912 wrote to memory of 4428 4912 syshost.exe 94 PID 4912 wrote to memory of 2428 4912 syshost.exe 95 PID 4912 wrote to memory of 2428 4912 syshost.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4373196495fd5bd61a3ca0dd086b415d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4373196495fd5bd61a3ca0dd086b415d.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\e7e1a2aa.tmp"2⤵
- System Location Discovery: System Language Discovery
PID:1652
-
-
C:\Windows\Installer\{D18F138F-C729-DB54-1DF8-4545FDD7D2F7}\syshost.exe"C:\Windows\Installer\{D18F138F-C729-DB54-1DF8-4545FDD7D2F7}\syshost.exe" /service1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe -set TESTSIGNING ON2⤵
- Modifies boot configuration data using bcdedit
- Enables test signing to bypass driver trust controls
PID:5000
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe -set TESTSIGNING ON2⤵
- Modifies boot configuration data using bcdedit
- Enables test signing to bypass driver trust controls
PID:3592
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe -set TESTSIGNING ON2⤵
- Modifies boot configuration data using bcdedit
- Enables test signing to bypass driver trust controls
PID:2292
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe -set TESTSIGNING ON2⤵
- Modifies boot configuration data using bcdedit
- Enables test signing to bypass driver trust controls
PID:1396
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe -set TESTSIGNING ON2⤵
- Modifies boot configuration data using bcdedit
- Enables test signing to bypass driver trust controls
PID:2896
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe -set TESTSIGNING ON2⤵
- Modifies boot configuration data using bcdedit
- Enables test signing to bypass driver trust controls
PID:2948
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe -set TESTSIGNING ON2⤵
- Modifies boot configuration data using bcdedit
- Enables test signing to bypass driver trust controls
PID:3512
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe -set TESTSIGNING ON2⤵
- Modifies boot configuration data using bcdedit
- Enables test signing to bypass driver trust controls
PID:772
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe -set TESTSIGNING ON2⤵
- Modifies boot configuration data using bcdedit
- Enables test signing to bypass driver trust controls
PID:4428
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe -set TESTSIGNING ON2⤵
- Modifies boot configuration data using bcdedit
- Enables test signing to bypass driver trust controls
PID:2428
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39ae055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD54373196495fd5bd61a3ca0dd086b415d
SHA17e80f5e068643383fc29991333a23608ed322976
SHA256ba531df27744b17a0006cda3da7751903ad9354cb5740c41a35913df05be0830
SHA5128576c0301afa4780e1637ba40fddba2c20075122273d7c95831ff782d2359c842e8e41066b1202937baefeff833b1163da1b883255bb0d81c940d817dc8ad7a8