Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 01:52
Static task
static1
Behavioral task
behavioral1
Sample
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe
-
Size
975KB
-
MD5
185cc9f3e3beacd8b0acb680fc70e8a4
-
SHA1
6cb610e875034fcedcc4ca666a2093947f8feb6a
-
SHA256
047b9549cc08b8749c2157d940bdfb737ea20a2bbf80089715f837b7041bea6d
-
SHA512
ada02977a7a7c97a0de040550c99cd54eb62d701c66709c44f689891981f4bde445614cf9eeab2ce2cef01d89e43c82e9dcd72370b3bcc36cbb17fa2da70a490
-
SSDEEP
12288:ngn5H64rtuq9uHUVsz+peuncYLXjsyBOjxcK1NcCjk+I7lGbl0sDgP3ngbr3aHi2:86MtuGuepHcYLzGjvcCjRI74gIryi
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
WinUdapter.exepid process 2564 WinUdapter.exe -
Loads dropped DLL 2 IoCs
Processes:
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exepid process 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinZip = "C:\\Users\\Admin\\AppData\\Roaming\\leftoverdccrypt.exe" 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exedescription pid process target process PID 1576 set thread context of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
WinUdapter.exedescription pid process Token: SeIncreaseQuotaPrivilege 2564 WinUdapter.exe Token: SeSecurityPrivilege 2564 WinUdapter.exe Token: SeTakeOwnershipPrivilege 2564 WinUdapter.exe Token: SeLoadDriverPrivilege 2564 WinUdapter.exe Token: SeSystemProfilePrivilege 2564 WinUdapter.exe Token: SeSystemtimePrivilege 2564 WinUdapter.exe Token: SeProfSingleProcessPrivilege 2564 WinUdapter.exe Token: SeIncBasePriorityPrivilege 2564 WinUdapter.exe Token: SeCreatePagefilePrivilege 2564 WinUdapter.exe Token: SeBackupPrivilege 2564 WinUdapter.exe Token: SeRestorePrivilege 2564 WinUdapter.exe Token: SeShutdownPrivilege 2564 WinUdapter.exe Token: SeDebugPrivilege 2564 WinUdapter.exe Token: SeSystemEnvironmentPrivilege 2564 WinUdapter.exe Token: SeChangeNotifyPrivilege 2564 WinUdapter.exe Token: SeRemoteShutdownPrivilege 2564 WinUdapter.exe Token: SeUndockPrivilege 2564 WinUdapter.exe Token: SeManageVolumePrivilege 2564 WinUdapter.exe Token: SeImpersonatePrivilege 2564 WinUdapter.exe Token: SeCreateGlobalPrivilege 2564 WinUdapter.exe Token: 33 2564 WinUdapter.exe Token: 34 2564 WinUdapter.exe Token: 35 2564 WinUdapter.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinUdapter.exepid process 2564 WinUdapter.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exedescription pid process target process PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe PID 1576 wrote to memory of 2564 1576 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinUdapter.exeC:\Users\Admin\AppData\Roaming\WinUdapter.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\WinUdapter.exeFilesize
1KB
MD57c32886c3cd06d6036c0462301ad289c
SHA1a0a54552a7ecf7082bac0af6c5bca610225b05df
SHA25672c341969754f9e11b85119ca8db22eba2f4a6173c6bac14a032360073799009
SHA51208613b8dc53125c6ff051a98989eb9c4eb447ad05243db1b956ae2969e8463c2a216ed6873274d5b3e890307ad219d761324aa702b3ee45f776b80336147d523
-
memory/1576-14-0x0000000074990000-0x0000000074F3B000-memory.dmpFilesize
5.7MB
-
memory/1576-0-0x0000000074991000-0x0000000074992000-memory.dmpFilesize
4KB
-
memory/1576-1-0x0000000074990000-0x0000000074F3B000-memory.dmpFilesize
5.7MB
-
memory/1576-2-0x0000000074990000-0x0000000074F3B000-memory.dmpFilesize
5.7MB
-
memory/2564-16-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2564-13-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2564-15-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2564-11-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2564-17-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2564-19-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2564-20-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2564-18-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2564-21-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2564-25-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB