Analysis
-
max time kernel
144s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 14:40
Static task
static1
Behavioral task
behavioral1
Sample
f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe
-
Size
16KB
-
MD5
f14cab39671f73d32332e9a554bd148f
-
SHA1
59a71ad6c2f820b8e65e62bb6210393e08af10e1
-
SHA256
1ceaebbf20a7ce1a6ddc9771c1f52322f99cf840d005da9c859609e502a48c7b
-
SHA512
e1932a4969d653047b6656b62a632bb2d7499ee998011ba8d2ebe0443c34ab42d57f50783f59494c9b7fa9d0a19366207af9e7cb7d25a0ef33a4d7ce23c2bef8
-
SSDEEP
384:E+tPt9G7ZBczDrlRDVAJ8sN6cH5q0omvG5krdcWZ:5tPt074zD5RDVA2sN6cR9qY
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000900000002325e-3.dat acprotect -
Loads dropped DLL 2 IoCs
pid Process 4860 f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe 4860 f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe -
resource yara_rule behavioral2/files/0x000900000002325e-3.dat upx behavioral2/memory/4860-6-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-9-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-11-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-13-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-14-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-16-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-17-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-19-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-21-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-23-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-25-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-27-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-29-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-31-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-33-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-35-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-37-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx behavioral2/memory/4860-39-0x0000000002CF0000-0x0000000002CF9000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\univrs32.dat f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://www.google.com/ie" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.google.com/ie" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com" f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4860 f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe 4860 f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe 4860 f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4860 f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe 4860 f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe 4860 f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f14cab39671f73d32332e9a554bd148f_JaffaCakes118.exe"1⤵
- Modifies firewall policy service
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3740 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:4764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5f77a0d439437a5d9b15b5484f9fb4284
SHA13e9892b37e19a3e771644d21bc5e09dbb255a951
SHA2563de87b3782015e2a37f65313b9ed2557a7a5ea74fccbd6c8a73d8cb2166c0d90
SHA5126a084106914806547343591aefa1930cab6165cd17e360898e649cc046ad07300927bebcb7287f0849a9f0594906f8fa4846d0bb5c25a41b3327461248028bb6