Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 00:39
Behavioral task
behavioral1
Sample
1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe
-
Size
646KB
-
MD5
1826a3c3cbaf8804560951543a1cf444
-
SHA1
54d252204e522b347e7ae12fde66ee6049c3d18a
-
SHA256
77d996c69a16c1be2b9ce2c80f10b89c3177dcdedde4f807898049c9af1fe372
-
SHA512
c79e510da682cee76a4d3f4509da73314a5752dc34b724de7da5aeb94208ccd3e29940f0989d34eddb28bcc4bfad771d9fca15f94eb496e736314faeae9b5491
-
SSDEEP
12288:g8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORix2:ZUKoN0bUxgGa/pfBHDb+y1HgZA
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 4824 msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeSecurityPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeSystemtimePrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeBackupPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeRestorePrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeShutdownPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeDebugPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeUndockPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeManageVolumePrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeImpersonatePrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: 33 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: 34 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: 35 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: 36 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 4824 msdcsc.exe Token: SeSecurityPrivilege 4824 msdcsc.exe Token: SeTakeOwnershipPrivilege 4824 msdcsc.exe Token: SeLoadDriverPrivilege 4824 msdcsc.exe Token: SeSystemProfilePrivilege 4824 msdcsc.exe Token: SeSystemtimePrivilege 4824 msdcsc.exe Token: SeProfSingleProcessPrivilege 4824 msdcsc.exe Token: SeIncBasePriorityPrivilege 4824 msdcsc.exe Token: SeCreatePagefilePrivilege 4824 msdcsc.exe Token: SeBackupPrivilege 4824 msdcsc.exe Token: SeRestorePrivilege 4824 msdcsc.exe Token: SeShutdownPrivilege 4824 msdcsc.exe Token: SeDebugPrivilege 4824 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4824 msdcsc.exe Token: SeChangeNotifyPrivilege 4824 msdcsc.exe Token: SeRemoteShutdownPrivilege 4824 msdcsc.exe Token: SeUndockPrivilege 4824 msdcsc.exe Token: SeManageVolumePrivilege 4824 msdcsc.exe Token: SeImpersonatePrivilege 4824 msdcsc.exe Token: SeCreateGlobalPrivilege 4824 msdcsc.exe Token: 33 4824 msdcsc.exe Token: 34 4824 msdcsc.exe Token: 35 4824 msdcsc.exe Token: 36 4824 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 4824 msdcsc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exedescription pid process target process PID 4080 wrote to memory of 4824 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe msdcsc.exe PID 4080 wrote to memory of 4824 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe msdcsc.exe PID 4080 wrote to memory of 4824 4080 1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1826a3c3cbaf8804560951543a1cf444_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4132,i,3671441404766730751,12082497324212183132,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
646KB
MD51826a3c3cbaf8804560951543a1cf444
SHA154d252204e522b347e7ae12fde66ee6049c3d18a
SHA25677d996c69a16c1be2b9ce2c80f10b89c3177dcdedde4f807898049c9af1fe372
SHA512c79e510da682cee76a4d3f4509da73314a5752dc34b724de7da5aeb94208ccd3e29940f0989d34eddb28bcc4bfad771d9fca15f94eb496e736314faeae9b5491
-
memory/4080-0-0x0000000002800000-0x0000000002801000-memory.dmpFilesize
4KB
-
memory/4080-13-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-19-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-21-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-16-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-17-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-18-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-14-0x00000000022B0000-0x00000000022B1000-memory.dmpFilesize
4KB
-
memory/4824-20-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-15-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-22-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-23-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-24-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-25-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-26-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-27-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4824-28-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB