Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 13:48
Behavioral task
behavioral1
Sample
1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
-
Size
746KB
-
MD5
1a5b56095e969cf84e0861808f6bbe80
-
SHA1
075191c1c4106dbf5a33c27a13342883e7b02677
-
SHA256
e87d887bc9e1a645cb827b7c73980fad1f0fc8c55e2887c0237f412f1ef2fe9e
-
SHA512
0dbfca01433f0688671dafbfec9b2d19ba995b85f5ec6c7bca14d7116ce790af9b741e8b46b11128d613e3c9bef210921f7b03f08832020f775758fbec9e02ad
-
SSDEEP
12288:O6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfha:zAmBpVKHu0Mu9Xo20VGLVP5a
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe -
Processes:
1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2644 attrib.exe 2684 attrib.exe -
Processes:
1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exepid process 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exedescription pid process Token: SeIncreaseQuotaPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeSecurityPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeSystemtimePrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeBackupPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeRestorePrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeShutdownPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeDebugPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeUndockPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeManageVolumePrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeImpersonatePrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: 33 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: 34 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Token: 35 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.execmd.execmd.exedescription pid process target process PID 1792 wrote to memory of 1228 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe cmd.exe PID 1792 wrote to memory of 1228 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe cmd.exe PID 1792 wrote to memory of 1228 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe cmd.exe PID 1792 wrote to memory of 1228 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe cmd.exe PID 1792 wrote to memory of 3048 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe cmd.exe PID 1792 wrote to memory of 3048 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe cmd.exe PID 1792 wrote to memory of 3048 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe cmd.exe PID 1792 wrote to memory of 3048 1792 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe cmd.exe PID 1228 wrote to memory of 2644 1228 cmd.exe attrib.exe PID 1228 wrote to memory of 2644 1228 cmd.exe attrib.exe PID 1228 wrote to memory of 2644 1228 cmd.exe attrib.exe PID 1228 wrote to memory of 2644 1228 cmd.exe attrib.exe PID 3048 wrote to memory of 2684 3048 cmd.exe attrib.exe PID 3048 wrote to memory of 2684 3048 cmd.exe attrib.exe PID 3048 wrote to memory of 2684 3048 cmd.exe attrib.exe PID 3048 wrote to memory of 2684 3048 cmd.exe attrib.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2644 attrib.exe 2684 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe"1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes