Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 06:24
Behavioral task
behavioral1
Sample
11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe
-
Size
463KB
-
MD5
11054033bc9a2065e532d018e8184ef1
-
SHA1
cef49e958c993be4d68e133324303900ce452004
-
SHA256
b2834c3754bb6e3d2960df0d84c64eb063321edc5d1b44c5c12e59a4bc58f529
-
SHA512
b01bff808415ed6f54d4b7544af91ba209eb0e11ffca5fa5b5db85aaad847a1a73694303f156f0e6a5530c41cfb21a7cfa4ed413d277eaafb754cc00c9442cfc
-
SSDEEP
12288:eOg7VoYcRVtowqG3WeWxRmpPRRBQ45xDCmTOGrstpzFst9:3gJJOswFW3xRe3BQ45xD5qGrJn
Malware Config
Extracted
latentbot
lootwillbeobtained.zapto.org
Signatures
-
Modifies firewall policy service 3 TTPs 10 IoCs
Processes:
reg.exereg.exereg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe:*:Enabled:Windows Messanger" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\local.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8ACE1AB-BFAC-83DB-EBEA-7C4D9EEDF9FA}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{F8ACE1AB-BFAC-83DB-EBEA-7C4D9EEDF9FA} 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{F8ACE1AB-BFAC-83DB-EBEA-7C4D9EEDF9FA}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8ACE1AB-BFAC-83DB-EBEA-7C4D9EEDF9FA} 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/432-0-0x0000000000400000-0x00000000004A5000-memory.dmp upx behavioral2/memory/432-4-0x0000000000400000-0x00000000004A5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\local.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\local.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exedescription pid process target process PID 432 set thread context of 428 432 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe -
Modifies registry key 1 TTPs 4 IoCs
Processes:
reg.exereg.exereg.exereg.exepid process 3376 reg.exe 3712 reg.exe 3496 reg.exe 1564 reg.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exepid process 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exedescription pid process Token: 1 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeCreateTokenPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeLockMemoryPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeMachineAccountPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeTcbPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeSecurityPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeLoadDriverPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeSystemProfilePrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeSystemtimePrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeBackupPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeRestorePrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeShutdownPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeDebugPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeAuditPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeUndockPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeSyncAgentPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeEnableDelegationPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeManageVolumePrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeImpersonatePrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: 31 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: 32 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: 33 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: 34 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe Token: 35 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exepid process 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe11054033bc9a2065e532d018e8184ef1_JaffaCakes118.execmd.execmd.execmd.execmd.exedescription pid process target process PID 432 wrote to memory of 428 432 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe PID 432 wrote to memory of 428 432 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe PID 432 wrote to memory of 428 432 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe PID 432 wrote to memory of 428 432 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe PID 432 wrote to memory of 428 432 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe PID 432 wrote to memory of 428 432 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe PID 432 wrote to memory of 428 432 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe PID 432 wrote to memory of 428 432 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe PID 428 wrote to memory of 3752 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe cmd.exe PID 428 wrote to memory of 3752 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe cmd.exe PID 428 wrote to memory of 3752 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe cmd.exe PID 428 wrote to memory of 4332 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe cmd.exe PID 428 wrote to memory of 4332 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe cmd.exe PID 428 wrote to memory of 4332 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe cmd.exe PID 428 wrote to memory of 4624 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe cmd.exe PID 428 wrote to memory of 4624 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe cmd.exe PID 428 wrote to memory of 4624 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe cmd.exe PID 428 wrote to memory of 1112 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe cmd.exe PID 428 wrote to memory of 1112 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe cmd.exe PID 428 wrote to memory of 1112 428 11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe cmd.exe PID 3752 wrote to memory of 3376 3752 cmd.exe reg.exe PID 3752 wrote to memory of 3376 3752 cmd.exe reg.exe PID 3752 wrote to memory of 3376 3752 cmd.exe reg.exe PID 4624 wrote to memory of 3712 4624 cmd.exe reg.exe PID 4624 wrote to memory of 3712 4624 cmd.exe reg.exe PID 4624 wrote to memory of 3712 4624 cmd.exe reg.exe PID 4332 wrote to memory of 3496 4332 cmd.exe reg.exe PID 4332 wrote to memory of 3496 4332 cmd.exe reg.exe PID 4332 wrote to memory of 3496 4332 cmd.exe reg.exe PID 1112 wrote to memory of 1564 1112 cmd.exe reg.exe PID 1112 wrote to memory of 1564 1112 cmd.exe reg.exe PID 1112 wrote to memory of 1564 1112 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\11054033bc9a2065e532d018e8184ef1_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3148,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Active Setup
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Active Setup
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/428-17-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/428-20-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/428-29-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/428-5-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/428-28-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/428-13-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/428-1-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/428-14-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/428-9-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/428-18-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/428-16-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/428-21-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/428-22-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/428-26-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/432-0-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/432-4-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB