Analysis
-
max time kernel
3s -
max time network
5s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe
Resource
win10v2004-20250314-en
General
-
Target
JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe
-
Size
600KB
-
MD5
8abe43cb15a9dd8d69f77c0c833c6809
-
SHA1
a011f0a13161d2dac9f01e609af99a4afc39b871
-
SHA256
fab208d4fde711f95e4da7fdfe3d7855f866bd2f367570aac74320952291faa1
-
SHA512
e66d77f0df46f46d278a9c22f204d346cbc9a4028d433307967421c9d62f4d54d26d5c8cd23511e733941c15b086e9d92925d5d55c5402770bdd90b509df2b1a
-
SSDEEP
12288:46onxOp8FySpE5zvIdtU+YmefaRfMMMMM2MMMMM:swp8DozAdO9aRfMMMMM2MMMMM
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" izfuneuesjp.exe -
Pykspa family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" izfuneuesjp.exe -
Detect Pykspa worm 1 IoCs
resource yara_rule behavioral1/files/0x000b000000012263-2.dat family_pykspa -
Executes dropped EXE 1 IoCs
pid Process 2052 izfuneuesjp.exe -
Loads dropped DLL 2 IoCs
pid Process 2248 JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe 2248 JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" izfuneuesjp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA izfuneuesjp.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\nabmjdvnxjhuqqolch.exe izfuneuesjp.exe File opened for modification C:\Windows\SysWOW64\ymoaytmfqdcqnonldjx.exe izfuneuesjp.exe File opened for modification C:\Windows\SysWOW64\ladqplfzlzzomoongncf.exe izfuneuesjp.exe File opened for modification C:\Windows\SysWOW64\aquiifavixyonqrrltjnb.exe izfuneuesjp.exe File opened for modification C:\Windows\SysWOW64\rincdbxthxzqquwxsbsxmn.exe izfuneuesjp.exe File opened for modification C:\Windows\SysWOW64\xihqldtjrbxicawr.exe izfuneuesjp.exe File opened for modification C:\Windows\SysWOW64\eqqawpgxgroavurnd.exe izfuneuesjp.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\rincdbxthxzqquwxsbsxmn.exe izfuneuesjp.exe File opened for modification C:\Windows\xihqldtjrbxicawr.exe izfuneuesjp.exe File opened for modification C:\Windows\eqqawpgxgroavurnd.exe izfuneuesjp.exe File opened for modification C:\Windows\nabmjdvnxjhuqqolch.exe izfuneuesjp.exe File opened for modification C:\Windows\ymoaytmfqdcqnonldjx.exe izfuneuesjp.exe File opened for modification C:\Windows\ladqplfzlzzomoongncf.exe izfuneuesjp.exe File opened for modification C:\Windows\aquiifavixyonqrrltjnb.exe izfuneuesjp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2248 JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe 2248 JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2052 2248 JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe 29 PID 2248 wrote to memory of 2052 2248 JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe 29 PID 2248 wrote to memory of 2052 2248 JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe 29 PID 2248 wrote to memory of 2052 2248 JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe 29 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System izfuneuesjp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" izfuneuesjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\izfuneuesjp.exe"C:\Users\Admin\AppData\Local\Temp\izfuneuesjp.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
600KB
MD58abe43cb15a9dd8d69f77c0c833c6809
SHA1a011f0a13161d2dac9f01e609af99a4afc39b871
SHA256fab208d4fde711f95e4da7fdfe3d7855f866bd2f367570aac74320952291faa1
SHA512e66d77f0df46f46d278a9c22f204d346cbc9a4028d433307967421c9d62f4d54d26d5c8cd23511e733941c15b086e9d92925d5d55c5402770bdd90b509df2b1a
-
Filesize
320KB
MD55203b6ea0901877fbf2d8d6f6d8d338e
SHA1c803e92561921b38abe13239c1fd85605b570936
SHA2560cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060
SHA512d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471